Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1395796
MD5:9565a774cce1318d00aad201d54179ad
SHA1:9369239b7c872d3cc46e55178eeda3cc6652e2e3
SHA256:9911129661bce9c536c1232b12b2aa19501d9dfae099c146d25308c7bb6839ac
Tags:exe
Infos:

Detection

Amadey, RisePro Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Yara detected Amadeys stealer DLL
Yara detected RisePro Stealer
Binary is likely a compiled AutoIt script file
Creates multiple autostart registry keys
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
PE file has nameless sections
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Creates job files (autostart)
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 5420 cmdline: C:\Users\user\Desktop\file.exe MD5: 9565A774CCE1318D00AAD201D54179AD)
    • schtasks.exe (PID: 1048 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 7096 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 1zSWTheo8gASwgtmbVnB.exe (PID: 7808 cmdline: "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe" MD5: 1E1CA4D43582C075F0CFF2992A8E6FEB)
      • chrome.exe (PID: 7880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 5468 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=1964,i,5887355526268781908,1189009886419855111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7908 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 6624 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1984,i,6749347610235560040,8445991958934204639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 8648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2020,i,9349519310739507833,11996823178141009930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7488 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 8932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1976,i,11539279321236040917,10474362654299226247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • msedge.exe (PID: 9184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com MD5: 69222B8101B0601CC6663F8381E7E00F)
        • msedge.exe (PID: 9624 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2080,i,6001142355176275865,11694759345999334586,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 9212 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video MD5: 69222B8101B0601CC6663F8381E7E00F)
        • msedge.exe (PID: 10044 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=2028,i,4605008049051892939,13077336860849041403,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 1576 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com MD5: 69222B8101B0601CC6663F8381E7E00F)
        • msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1120 --field-trial-handle=2024,i,16006183332478894821,13298773514920591943,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • chrome.exe (PID: 9280 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 9672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 9980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • firefox.exe (PID: 5720 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 10312 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 10424 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • schtasks.exe (PID: 9196 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 8232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 9988 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 10008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • _z8_twA5gL3uyAKSYBl4.exe (PID: 7692 cmdline: "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe" MD5: F2DFD8B4E7B7BE57BB23484FC9D14430)
  • MPGPH131.exe (PID: 6632 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 9565A774CCE1318D00AAD201D54179AD)
  • MPGPH131.exe (PID: 5784 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 9565A774CCE1318D00AAD201D54179AD)
    • SIHClient.exe (PID: 7616 cmdline: C:\Windows\System32\sihclient.exe /cv oDBIuu78qUSLDogbPZYF5w.0.2 MD5: 8BE47315BF30475EEECE8E39599E9273)
  • RageMP131.exe (PID: 7416 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 9565A774CCE1318D00AAD201D54179AD)
  • RageMP131.exe (PID: 9416 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 9565A774CCE1318D00AAD201D54179AD)
  • MSIUpdaterV131.exe (PID: 10092 cmdline: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe MD5: F2DFD8B4E7B7BE57BB23484FC9D14430)
  • msedge.exe (PID: 9472 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 10608 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 11484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6352 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 11668 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • firefox.exe (PID: 10568 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 10616 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 11356 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2164 -prefMapHandle 2156 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78885992-7c24-4bea-b4cd-80bc1adb5941} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fbfe16e710 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 12592 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3672 -childID 1 -isForBrowser -prefsHandle 1216 -prefMapHandle 3664 -prefsLen 21867 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe175a33-28a2-4047-aeec-757513839c5e} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8f78ca10 tab MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 12728 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2556 -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 2968 -prefsLen 22057 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a7ce19a-c0e1-4606-ade3-f9e411e1fb00} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8b43cf50 tab MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • MSIUpdaterV131.exe (PID: 11168 cmdline: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe MD5: F2DFD8B4E7B7BE57BB23484FC9D14430)
  • firefox.exe (PID: 7444 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 11340 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 6208 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • AdobeUpdaterV131.exe (PID: 12560 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe" MD5: F2DFD8B4E7B7BE57BB23484FC9D14430)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
AmadeyAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\h8ozYGRfpZBL_1uFxRWmLJY.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
    C:\Users\user\AppData\Local\Temp\7VjcYwCMF_u_3bGwi0Uji59.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
      C:\Users\user\AppData\Local\Temp\NsDq1AXD5Zu7PIsqGltDvI0.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
        C:\Users\user\AppData\Local\Temp\Ci0SBvvC_ABy4cFBW3g7apa.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          00000021.00000002.2976732828.0000000000651000.00000040.00000001.01000000.0000000B.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
            00000021.00000003.2482885181.0000000004BF0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
              00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
                0000002A.00000002.2883089894.0000000000651000.00000040.00000001.01000000.0000000B.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                  0000002A.00000003.2481062424.0000000004FA0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                    Click to see the 3 entries

                    Unpacked PEs

                    SourceRuleDescriptionAuthorStrings
                    44.2._z8_twA5gL3uyAKSYBl4.exe.ca0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                      42.2.MSIUpdaterV131.exe.650000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                        33.2.MSIUpdaterV131.exe.650000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security

                          Sigma Signatures

                          System Summary

                          barindex
                          Sigma detected: CurrentVersion Autorun Keys Modification
                          Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 5420, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131
                          Sigma detected: Startup Folder File Write
                          Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 5420, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk

                          Snort Signatures

                          ⊘No Snort rule has matched

                          Joe Sandbox Signatures

                          Click to jump to signature section

                          Show All Signature Results

                          AV Detection

                          barindex
                          Antivirus detection for URL or domain
                          Source: http://185.215.113.46/cost/ladas.exe(;Avira URL Cloud: Label: malware
                          Source: http://185.215.113.46/cost/ladas.exesive.dllAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/cost/ladas.exeidiAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/cost/fu.exeagerntAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/cost/fu.exeAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/mine/amert.exeAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/cost/well.exeAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/cost/ladas.exeAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/mine/plaza.exeidizS9SzeRnCJb5Z-4XAvira URL Cloud: Label: malware
                          Source: http://185.215.113.46/cost/ladas.exebAvira URL Cloud: Label: malware
                          Antivirus detection for dropped file
                          Source: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                          Multi AV Scanner detection for domain / URL
                          Source: http://185.215.113.46/mine/amert.exeVirustotal: Detection: 20%Perma Link
                          Source: http://185.215.113.46/cost/fu.exeVirustotal: Detection: 23%Perma Link
                          Source: http://185.215.113.46/cost/ladas.exesive.dllVirustotal: Detection: 14%Perma Link
                          Source: http://185.215.113.46/cost/ladas.exeVirustotal: Detection: 19%Perma Link
                          Source: http://185.215.113.46/cost/ladas.exebVirustotal: Detection: 16%Perma Link
                          Source: http://185.215.113.46/cost/well.exeVirustotal: Detection: 21%Perma Link
                          Multi AV Scanner detection for dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeVirustotal: Detection: 54%Perma Link
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeVirustotal: Detection: 59%Perma Link
                          Source: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exeVirustotal: Detection: 59%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\fu[1].exeVirustotal: Detection: 33%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ladas[1].exeVirustotal: Detection: 52%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\niks[1].exeVirustotal: Detection: 55%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\well[1].exeVirustotal: Detection: 29%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\amert[1].exeVirustotal: Detection: 59%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ladas[1].exeVirustotal: Detection: 52%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\niks[1].exeVirustotal: Detection: 55%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\plaza[1].exeVirustotal: Detection: 54%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\well[1].exeVirustotal: Detection: 29%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ladas[1].exeVirustotal: Detection: 52%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\plaza[1].exeVirustotal: Detection: 54%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\well[1].exeVirustotal: Detection: 29%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exeVirustotal: Detection: 59%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[2].exeVirustotal: Detection: 59%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[1].exeVirustotal: Detection: 33%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[2].exeVirustotal: Detection: 33%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\niks[1].exeVirustotal: Detection: 55%Perma Link
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\plaza[1].exeVirustotal: Detection: 54%Perma Link
                          Machine Learning detection for dropped file
                          Source: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exeJoe Sandbox ML: detected
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeJoe Sandbox ML: detected
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeJoe Sandbox ML: detected
                          Machine Learning detection for sample
                          Source: file.exeJoe Sandbox ML: detected
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FAFFC0 CryptUnprotectData,CryptUnprotectData,0_2_00FAFFC0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B9FFC0 CryptUnprotectData,CryptUnprotectData,8_2_00B9FFC0
                          Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9C050 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,0_2_00F9C050
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0106B4E5 FindFirstFileExW,0_2_0106B4E5
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B8C050 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,8_2_00B8C050
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C5B4E5 recv,FindFirstFileExW,8_2_00C5B4E5
                          Source: firefox.exeMemory has grown: Private usage: 1MB later: 233MB
                          Source: Joe Sandbox ViewIP Address: 13.107.6.158 13.107.6.158
                          Source: Joe Sandbox ViewIP Address: 204.79.197.200 204.79.197.200
                          Source: Joe Sandbox ViewIP Address: 13.107.246.40 13.107.246.40
                          Source: Joe Sandbox ViewIP Address: 185.215.113.46 185.215.113.46
                          Source: Joe Sandbox ViewIP Address: 185.215.113.46 185.215.113.46
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B9DBB0 recv,WSAStartup,closesocket,socket,connect,closesocket,8_2_00B9DBB0
                          Source: firefox.exe, 00000023.00000002.2300285719.0000022AC2BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000023.00000002.2300285719.0000022AC2BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.comd equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2483237784.000001FB91FC8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: g>Wmoz-nullprincipal:{871a8f96-2762-43e2-9f78-1f95eca451fd}?https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2617487083.0000000005C13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2617487083.0000000005C13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com//pp equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000025.00000002.2344153551.000002A80BEC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000025.00000002.2344153551.000002A80BEC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/videos equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000027.00000002.2303785942.00000226FD9C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2484170838.000001FB91F0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: "www.facebook.com equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2895883925.000001FB98DD0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: ,~predictor-origin,:https://www.facebook.com/predictor::seen1 equals www.facebook.com (Facebook)
                          Source: MPGPH131.exe, 00000007.00000003.2640674394.0000000000976000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: -_https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2463892026.000001FB9A5F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: .S........[tlsflags0x00000000]www.facebook.com:443^partitionKey=%28https%2Cfacebook.com%29 equals www.facebook.com (Facebook)
                          Source: MPGPH131.exe, 00000006.00000003.2813901630.0000000005E88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: .www.linkedin.combscookiev10@} equals www.linkedin.com (Linkedin)
                          Source: firefox.exe, 00000023.00000003.2273836507.0000022AC46FC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2300748777.0000022AC46FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 0`0https://www.youtube.com --attempting-deelevationUser equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2640674394.0000000000976000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 5_https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2640674394.0000000000976000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 6_https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000025.00000002.2344720109.000002A80D9A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 7n7https://www.facebook.com/video --attempting-deelevationUser equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2893642009.000001FB9BEF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2852837545.000001FB9BEF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8:https://www.facebook.com/video equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2463892026.000001FB9A5F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8:https://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2704649310.000001FB984E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2436535853.000001FB92711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2702286694.000001FB98645000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2859579934.000001FB98645000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2995740845.000001FB9BEF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2436535853.000001FB92711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2696716926.000001FB98A40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464498833.000001FB98A69000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com/video equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2919241842.000001FB973D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2475084912.000001FB9657F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2471449950.000001FB9738C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2919241842.000001FB973D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3020159159.000001FB973D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2859862617.000001FB973D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com/` equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2466799961.000001FB98684000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3016232028.000001FB98684000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2910522324.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2484170838.000001FB91F0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2893642009.000001FB9BEF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2852837545.000001FB9BEF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: :https://www.facebook.com/video equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2463892026.000001FB9A5F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: :https://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000006.00000003.2813901630.0000000005E88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ;.www.linkedin.comli_1x equals www.linkedin.com (Linkedin)
                          Source: MPGPH131.exe, 00000006.00000003.2813901630.0000000005E88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ;.www.linkedin.comli_rmv10 equals www.linkedin.com (Linkedin)
                          Source: firefox.exe, 00000029.00000003.2301349556.000001FB805D5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2299483431.000001FB805D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: =::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCMOZ_CRASHREPORTER_DATA_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash ReportsMOZ_CRASHREPORTER_EVENTS_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\eventsMOZ_CRASHREPORTER_PING_DIRECTORY=C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending PingsMOZ_CRASHREPORTER_RESTART_ARG_0=C:\Program Files\Mozilla Firefox\firefox.exeMOZ_CRASHREPORTER_RESTART_ARG_1=https://www.youtube.comMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:\Program Files\Mozilla Firefox\browser\crashreporter-override.iniNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files\Mozilla Firefox;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2696716926.000001FB98A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464498833.000001FB98A1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: =e=nssBadCert&u=https%3A//www.facebook.com/video&c=UTF-8&d=%20 equals www.facebook.com (Facebook)
                          Source: MPGPH131.exe, 00000007.00000003.2640674394.0000000000976000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: >_https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000025.00000002.2344153551.000002A80BEC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.facebook.com/video5 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000023.00000002.2300285719.0000022AC2BCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000027.00000002.2303785942.00000226FD9C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com--attempting-deelevation equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000025.00000002.2344153551.000002A80BEC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/videoC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default7 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000023.00000002.2300285719.0000022AC2BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.comC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000027.00000002.2303785942.00000226FD9C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2640674394.0000000000976000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: META:https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2696716926.000001FB98A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Mabout:certerror?e=nssBadCert&u=https%3A//www.facebook.com/video&c=UTF-8&d=%20 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2463892026.000001FB9A5F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2640674394.0000000000976000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: _https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2696716926.000001FB98A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3020159159.000001FB973DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.facebook.com/video&c=UTF-8&d=%20 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2696716926.000001FB98A1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464498833.000001FB98A1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: e=nssBadCert&u=https%3A//www.facebook.com/video&c=UTF-8&d=%20 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2704649310.000001FB984E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2436535853.000001FB92711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2696716926.000001FB98A40000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2859579934.000001FB98645000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2995740845.000001FB9BEF4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2436535853.000001FB92711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2872351728.000001FB8AEAB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2696716926.000001FB98A1C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/video equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2696716926.000001FB98A40000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464498833.000001FB98A40000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/video@ equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2901527515.000001FB98D76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98D76000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2617487083.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2613733396.0000000000992000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3055686788.0000000005DB8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2617487083.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2613733396.0000000000992000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com//pp equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2616339617.0000000005C2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/YouTube equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2616339617.0000000005C2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/YouTube/pp equals www.youtube.com (Youtube)
                          Source: RageMP131.exe, 00000008.00000002.3051142522.0000000005AD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ta1 equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.3014027476.000001FB986CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2466799961.000001FB986CA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2699799932.000001FB986CA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: moz-nullprincipal:{43f7831d-84c8-401b-a3d5-bbed60e76247}?https://www.facebook.com equals www.facebook.com (Facebook)
                          Source: MPGPH131.exe, 00000006.00000003.2813901630.0000000005E88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: r.www.linkedin.comJSESSIONIDv10vmV equals www.linkedin.com (Linkedin)
                          Source: firefox.exe, 00000025.00000003.2336243926.000002A80BEDC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.2344153551.000002A80BEE1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.facebook.com/video --attempting-deelevation equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000023.00000003.2273743981.0000022AC2BDC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000023.00000002.2300285719.0000022AC2BE1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.youtube.com --attempting-deelevation equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2613733396.0000000000992000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2431237956.0000000005C47000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2613733396.0000000000992000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2861010042.000001FB9654D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2514495452.000001FB91E0E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: tlsflags0x00000000:www.facebook.com:443^partitionKey=%28https%2Cfacebook.com%29 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2861010042.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2861010042.000001FB9654D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2514495452.000001FB91E0E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2613733396.0000000000992000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ttps://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: MPGPH131.exe, 00000007.00000003.2613733396.0000000000992000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ttps://www.youtube.com//pp equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2905705692.000001FB986B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2630257032.000001FB8FCB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2618159844.000001FB932B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2588522719.000001FB8FCA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2509480913.000001FB91ED4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2919241842.000001FB973E8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2561957552.000001FB9119F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.comP43 equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2588522719.000001FB8FCA9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2732891901.000001FB9323F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2645881221.000001FB93237000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2732891901.000001FB9323F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2645881221.000001FB93237000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.comoZ equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.3024799346.000001FB97320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2860733025.000001FB97320000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2927581358.000001FB97320000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: x*://www.facebook.com/platform/impression.php* equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2463892026.000001FB9A5F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: x.S........[tlsflags0x00000000]www.facebook.com:443^partitionKey=%28https%2Cfacebook.com%29 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2463892026.000001FB9A5F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.3020159159.000001FB973DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2477590188.000001FB92779000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2477590188.000001FB927CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.facebook.com/video&c=UTF-8&d=%20 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2854768436.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xhttps://www.facebook.com/video equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2514495452.000001FB91E0E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xtlsflags0x00000000:www.facebook.com:443^partitionKey=%28https%2Cfacebook.com%29 equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2514495452.000001FB91E0E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                          Source: firefox.exe, 00000029.00000003.2895883925.000001FB98DD0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: ~predictor-origin,:https://www.facebook.com/ equals www.facebook.com (Facebook)
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9652B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2484170838.000001FB91F0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
                          Source: file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3046630470.0000000005D2D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe
                          Source: RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe)
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exeagernt
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.000000000147E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe
                          Source: file.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe(;
                          Source: file.exe, 00000000.00000002.2976955927.000000000097B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exeb
                          Source: RageMP131.exe, 00000008.00000002.2980143223.00000000004DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exeidi
                          Source: file.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2976955927.000000000097B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exel
                          Source: file.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exelF~n
                          Source: file.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exesive.dll
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exe
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exe
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000097B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2976955927.000000000097B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/amert.exe
                          Source: file.exe, 00000000.00000003.2389626209.000000000097B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2976955927.000000000097B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/amert.exe#
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/amert.exed-
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.000000000147E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exeOB
                          Source: file.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exeidizS9SzeRnCJb5Z-4X
                          Source: firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
                          Source: SIHClient.exe, 00000009.00000003.2565092652.00000205739EE000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000002.2893638622.00000205739EE000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000003.2576373237.00000205739EE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micrA
                          Source: SIHClient.exe, 00000009.00000003.2187881101.0000020574385000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000002.2900308468.0000020574380000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000003.2185652439.0000020574385000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micro
                          Source: firefox.exe, 00000029.00000003.3002271050.000001FB98D9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2472568638.000001FB9734E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3024799346.000001FB9734B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
                          Source: firefox.exe, 00000029.00000003.2861010042.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2935452112.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2514495452.000001FB91E0E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
                          Source: firefox.exe, 00000029.00000003.2854768436.000001FB98D76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2514495452.000001FB91E0E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
                          Source: firefox.exe, 00000029.00000003.2847640406.000001FB93284000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2407004515.000001FB966B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2407473308.000001FB966B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2765495710.000001FB8EC7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2809831387.000001FB8AE2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2449113424.000001FB98582000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2634765865.000001FB8EA58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2868107380.000001FB985F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2713037412.000001FB8EAA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2755126218.000001FB8EB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2732544717.000001FB985F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3012126900.000001FB986E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2735455297.000001FB8EA59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2902867703.000001FB986E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2514495452.000001FB91E08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2737019437.000001FB8EAA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2887497625.000001FB8EAA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2807551644.000001FB8EC7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2568960989.000001FB8EAB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2862972274.000001FB966F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2360064713.000001FB8EC7E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
                          Source: firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
                          Source: firefox.exe, 00000029.00000003.2512787341.000001FB91E84000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.i.lencr.org/0.
                          Source: firefox.exe, 00000029.00000003.2512787341.000001FB91E84000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.o.lencr.org0
                          Source: firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
                          Source: firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
                          Source: firefox.exe, 00000029.00000003.2703606554.000001FB984F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2859736818.000001FB984EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2565078704.000001FB91143000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3017763773.000001FB984EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2915639608.000001FB984EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2563091715.000001FB91184000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
                          Source: firefox.exe, 00000029.00000003.2565078704.000001FB91143000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2563091715.000001FB91184000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul8
                          Source: firefox.exe, 00000029.00000003.2563091715.000001FB91184000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulh
                          Source: file.exe, 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1999562541.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2065812545.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2066983405.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2991732572.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2168758239.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2878089392.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.2360402306.0000000005230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
                          Source: firefox.exe, 00000029.00000003.2353070103.000001FB8E965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352450205.000001FB8E924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2353477536.000001FB8E985000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352149654.000001FB8EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                          Source: firefox.exe, 00000029.00000003.2472568638.000001FB9732E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
                          Source: firefox.exe, 00000029.00000003.2692073703.000001FB98A7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464498833.000001FB98A7F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.firefox.comK
                          Source: firefox.exe, 00000026.00000002.2336728837.000002C2A6C50000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2862162587.000001FB964EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2938825525.000001FB964EB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
                          Source: firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
                          Source: firefox.exe, 00000029.00000003.2895883925.000001FB98DD0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/predictor::seen1
                          Source: firefox.exe, 00000026.00000002.2336728837.000002C2A6C50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comC:
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/
                          Source: firefox.exe, 00000029.00000003.2484170838.000001FB91F0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
                          Source: firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
                          Source: firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
                          Source: firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
                          Source: firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
                          Source: firefox.exe, 00000029.00000003.2809831387.000001FB8AE2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2838114200.000001FB8AE2F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2404581198.0000000005C53000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2404581198.0000000005C53000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                          Source: firefox.exe, 00000029.00000003.2353070103.000001FB8E965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352450205.000001FB8E924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2353477536.000001FB8E985000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352149654.000001FB8EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
                          Source: firefox.exe, 00000029.00000003.2702286694.000001FB98645000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2861010042.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2930019942.000001FB965CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB965FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/
                          Source: firefox.exe, 00000029.00000003.2930019942.000001FB965CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
                          Source: firefox.exe, 00000029.00000003.2477590188.000001FB92754000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2935452112.000001FB96558000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?t=ffab&q=
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                          Source: firefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
                          Source: firefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
                          Source: firefox.exe, 00000029.00000003.2457073466.000001FB8FCAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2455731909.000001FB8FC82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
                          Source: firefox.exe, 00000029.00000003.2691872849.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
                          Source: firefox.exe, 00000029.00000003.2691872849.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
                          Source: firefox.exe, 00000029.00000003.2691872849.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
                          Source: firefox.exe, 00000029.00000003.2930019942.000001FB9659F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
                          Source: firefox.exe, 00000029.00000003.2691872849.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
                          Source: firefox.exe, 00000029.00000003.2407473308.000001FB966B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2874355917.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2407004515.000001FB96671000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2846603963.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2747711649.000001FB966A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2870582921.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2648611710.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2626143185.000001FB9667E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
                          Source: firefox.exe, 00000029.00000003.2407473308.000001FB966B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2874355917.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2407004515.000001FB96671000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2846603963.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2747711649.000001FB966A0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2870582921.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2648611710.000001FB9669D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2626143185.000001FB9667E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
                          Source: firefox.exe, 00000029.00000003.2353070103.000001FB8E965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352450205.000001FB8E924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352149654.000001FB8EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
                          Source: firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
                          Source: firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
                          Source: firefox.exe, 00000029.00000003.3020159159.000001FB9739A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com
                          Source: firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gpuweb.github.io/gpuweb/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2861010042.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2930019942.000001FB965CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
                          Source: RageMP131.exe, 00000008.00000002.2980143223.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000147E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000147E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/Mozilla/5.0
                          Source: file.exe, 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1999562541.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2065812545.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2066983405.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2991732572.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2168758239.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2878089392.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.2360402306.0000000005230000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/nProtM
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2976955927.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.000000000051E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000147E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.222
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.222B
                          Source: RageMP131.exe, 00000008.00000002.2980143223.000000000051E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/191.96.227.222p
                          Source: file.exe, 00000000.00000002.2976955927.00000000008BE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.227.222
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.227.222EHkN)
                          Source: RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/191.96.227.222T
                          Source: firefox.exe, 00000029.00000003.2861010042.000001FB9656C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2930019942.000001FB9656C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema
                          Source: firefox.exe, 00000029.00000003.2472568638.000001FB9732E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                          Source: firefox.exe, 00000029.00000003.2472568638.000001FB9732E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
                          Source: firefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
                          Source: firefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
                          Source: firefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
                          Source: firefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
                          Source: firefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
                          Source: firefox.exe, 00000029.00000003.2854768436.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9652B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
                          Source: firefox.exe, 00000029.00000003.2484170838.000001FB91F0A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSy
                          Source: firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
                          Source: firefox.exe, 00000029.00000003.2560855040.000001FB912E2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com
                          Source: firefox.exe, 00000029.00000003.2560855040.000001FB912E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/
                          Source: firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
                          Source: firefox.exe, 00000029.00000003.2699380184.000001FB986F6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
                          Source: firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
                          Source: firefox.exe, 00000029.00000003.2436535853.000001FB92737000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2935452112.000001FB9654D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2861010042.000001FB9654D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs
                          Source: firefox.exe, 00000029.00000003.2854768436.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
                          Source: firefox.exe, 00000029.00000003.2854768436.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
                          Source: firefox.exe, 00000029.00000003.2702397446.000001FB98642000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
                          Source: firefox.exe, 00000029.00000003.2560855040.000001FB912CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
                          Source: firefox.exe, 00000029.00000003.2860186459.000001FB9739A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3020159159.000001FB9739A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2859579934.000001FB98645000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2706123123.000001FB9739B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2702286694.000001FB98645000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2921343886.000001FB9739A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
                          Source: firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                          Source: firefox.exe, 00000029.00000003.2723175944.000001FB8EBDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2608964060.000001FB8EBDC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
                          Source: firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.)
                          Source: RageMP131.exe, 00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.00000000005A4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT
                          Source: RageMP131.exe, 00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORThoS
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot5
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botG0
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botY0
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botwB7O
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464067429.000001FB98DFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
                          Source: firefox.exe, 00000029.00000003.2703606554.000001FB984F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB965CD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search
                          Source: firefox.exe, 00000029.00000003.2436535853.000001FB9274A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
                          Source: file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2404581198.0000000005C53000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB96546000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
                          Source: firefox.exe, 00000029.00000003.2462883387.000001FB9BEC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2702397446.000001FB98642000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464498833.000001FB98A49000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
                          Source: firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
                          Source: firefox.exe, 00000029.00000003.2457073466.000001FB8FCAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2455731909.000001FB8FC82000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
                          Source: firefox.exe, 00000029.00000003.2433245091.000001FB9278A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/anything/?
                          Source: firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
                          Source: file.exe, 00000000.00000003.2144512810.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158598098.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157484063.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115223948.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114512820.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2116875878.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155154432.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117311152.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3045108093.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117924699.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2119592335.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134765646.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2302523520.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2277486245.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3051963799.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2303108433.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2312179593.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                          Source: firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                          Source: file.exe, 00000000.00000003.2144512810.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158598098.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157484063.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115223948.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114512820.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2116875878.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155154432.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117311152.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3045108093.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117924699.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2119592335.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134765646.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2302523520.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2277486245.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3051963799.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2303108433.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2312179593.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
                          Source: file.exe, 00000000.00000003.2144512810.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2158598098.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2157484063.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2115223948.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2114512820.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2116875878.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155154432.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117311152.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3045108093.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2117924699.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2119592335.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2134765646.0000000005C8E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2302523520.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2277486245.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.3051963799.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2303108433.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2312179593.0000000005BEF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                          Source: RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/s
                          Source: firefox.exe, 00000029.00000003.2472568638.000001FB9732E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464067429.000001FB98DFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
                          Source: firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
                          Source: firefox.exe, 00000027.00000002.2303785942.00000226FD9C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2483237784.000001FB91FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2901527515.000001FB98D76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98D76000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com
                          Source: firefox.exe, 00000027.00000002.2303785942.00000226FD9C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com--attempting-deelevation
                          Source: firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
                          Source: MPGPH131.exe, 00000007.00000003.2617487083.0000000005C13000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2613733396.0000000000992000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com//pp
                          Source: MPGPH131.exe, 00000007.00000003.2614228154.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2616339617.0000000005C2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/YouTube
                          Source: MPGPH131.exe, 00000007.00000003.2614228154.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2616339617.0000000005C2A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/YouTube/pp
                          Source: RageMP131.exe, 00000008.00000002.3051142522.0000000005AD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ta1
                          Source: firefox.exe, 00000023.00000002.2300285719.0000022AC2BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.comC:
                          Source: firefox.exe, 00000029.00000003.2301349556.000001FB805D5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2299483431.000001FB805D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.comMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
                          Source: firefox.exe, 00000023.00000002.2300285719.0000022AC2BC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.comd
                          Source: firefox.exe, 00000029.00000003.2464067429.000001FB98DFB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
                          Source: firefox.exe, 00000029.00000003.2562452943.000001FB91193000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://youtube.com

                          System Summary

                          barindex
                          Binary is likely a compiled AutoIt script file
                          Source: file.exe, 00000000.00000003.2426464372.0000000006328000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_6c64d182-0
                          Source: file.exe, 00000000.00000003.2426464372.0000000006328000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_80e1078d-f
                          Source: MPGPH131.exe, 00000006.00000003.2953181412.0000000005C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_136bab35-4
                          Source: MPGPH131.exe, 00000006.00000003.2953181412.0000000005C88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_8fc55a00-7
                          Source: MPGPH131.exe, 00000007.00000003.2992008424.00000000064F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_534e2795-1
                          Source: MPGPH131.exe, 00000007.00000003.2992008424.00000000064F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_f7ff4ccc-3
                          Source: RageMP131.exe, 00000008.00000003.2633598752.0000000007731000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_331cce5e-6
                          Source: RageMP131.exe, 00000008.00000003.2633598752.0000000007731000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_546a719a-3
                          Source: 1zSWTheo8gASwgtmbVnB.exe, 0000000A.00000000.2193237793.00000000007A2000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_cbaa8c0f-f
                          Source: 1zSWTheo8gASwgtmbVnB.exe, 0000000A.00000000.2193237793.00000000007A2000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_cbb4be20-7
                          PE file contains section with special chars
                          Source: file.exeStatic PE information: section name:
                          Source: file.exeStatic PE information: section name: .idata
                          Source: file.exeStatic PE information: section name:
                          Source: RageMP131.exe.0.drStatic PE information: section name:
                          Source: RageMP131.exe.0.drStatic PE information: section name: .idata
                          Source: RageMP131.exe.0.drStatic PE information: section name:
                          Source: MPGPH131.exe.0.drStatic PE information: section name:
                          Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
                          Source: MPGPH131.exe.0.drStatic PE information: section name:
                          Source: ladas[1].exe.0.drStatic PE information: section name:
                          Source: ladas[1].exe.0.drStatic PE information: section name: .idata
                          Source: ladas[1].exe.0.drStatic PE information: section name:
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name:
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name: .idata
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name:
                          Source: EdgeMS131.exe.0.drStatic PE information: section name:
                          Source: EdgeMS131.exe.0.drStatic PE information: section name: .idata
                          Source: EdgeMS131.exe.0.drStatic PE information: section name:
                          Source: niks[1].exe.0.drStatic PE information: section name:
                          Source: niks[1].exe.0.drStatic PE information: section name: .idata
                          Source: niks[1].exe.0.drStatic PE information: section name:
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name:
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name: .idata
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name:
                          Source: amert[1].exe.0.drStatic PE information: section name:
                          Source: amert[1].exe.0.drStatic PE information: section name: .idata
                          Source: amert[1].exe.0.drStatic PE information: section name:
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name:
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name: .idata
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name:
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: .idata
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: .idata
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name:
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name: .idata
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name:
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name:
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name: .idata
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name:
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name:
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name: .idata
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name:
                          Source: ladas[1].exe.7.drStatic PE information: section name:
                          Source: ladas[1].exe.7.drStatic PE information: section name: .idata
                          Source: ladas[1].exe.7.drStatic PE information: section name:
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name:
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name: .idata
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name:
                          Source: amert[2].exe.7.drStatic PE information: section name:
                          Source: amert[2].exe.7.drStatic PE information: section name: .idata
                          Source: amert[2].exe.7.drStatic PE information: section name:
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name:
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name: .idata
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name:
                          Source: niks[1].exe.7.drStatic PE information: section name:
                          Source: niks[1].exe.7.drStatic PE information: section name: .idata
                          Source: niks[1].exe.7.drStatic PE information: section name:
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name:
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name: .idata
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name:
                          Source: niks[1].exe.8.drStatic PE information: section name:
                          Source: niks[1].exe.8.drStatic PE information: section name: .idata
                          Source: niks[1].exe.8.drStatic PE information: section name:
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name:
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name: .idata
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name:
                          Source: ladas[1].exe.8.drStatic PE information: section name:
                          Source: ladas[1].exe.8.drStatic PE information: section name: .idata
                          Source: ladas[1].exe.8.drStatic PE information: section name:
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name:
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name: .idata
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name:
                          Source: amert[1].exe.8.drStatic PE information: section name:
                          Source: amert[1].exe.8.drStatic PE information: section name: .idata
                          Source: amert[1].exe.8.drStatic PE information: section name:
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name:
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name: .idata
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name:
                          PE file has nameless sections
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B8A450 RtlAllocateHeap,NtQuerySystemInformation,HeapFree,RtlFreeHeap,RtlAllocateHeap,NtQuerySystemInformation,HeapFree,8_2_00B8A450
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B8A770 NtDuplicateObject,CreateThread,RtlUnicodeStringToAnsiString,TerminateThread,8_2_00B8A770
                          Source: C:\Windows\System32\SIHClient.exeFile created: C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP9A83.tmp
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeFile deleted: C:\Windows\Tasks\explorgu.job
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC48E00_2_00FC48E0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0106A9300_2_0106A930
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC08900_2_00FC0890
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9F0500_2_00F9F050
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC10100_2_00FC1010
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FD20100_2_00FD2010
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FED1800_2_00FED180
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FE39100_2_00FE3910
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FE52B00_2_00FE52B0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FB5A900_2_00FB5A90
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FBBA600_2_00FBBA60
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FD22500_2_00FD2250
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA13C00_2_00FA13C0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FDDB800_2_00FDDB80
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FD03600_2_00FD0360
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FE33500_2_00FE3350
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC8C900_2_00FC8C90
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010245E00_2_010245E0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FCD5A00_2_00FCD5A0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC65900_2_00FC6590
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA05800_2_00FA0580
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FB85700_2_00FB8570
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0107970D0_2_0107970D
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FBDE700_2_00FBDE70
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC76600_2_00FC7660
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FB07800_2_00FB0780
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FBA7600_2_00FBA760
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FB47300_2_00FB4730
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FCA7000_2_00FCA700
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F920500_2_00F92050
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010740080_2_01074008
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010760400_2_01076040
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010008500_2_01000850
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010708800_2_01070880
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FAA1500_2_00FAA150
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0108D3110_2_0108D311
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FE82E00_2_00FE82E0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F922C00_2_00F922C0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FC02C00_2_00FC02C0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010223600_2_01022360
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_010873C40_2_010873C4
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01079A4F0_2_01079A4F
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01011A500_2_01011A50
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9ABA00_2_00F9ABA0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0102D2C00_2_0102D2C0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0101D5300_2_0101D530
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01014D300_2_01014D30
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FEA5400_2_00FEA540
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0108F4C00_2_0108F4C0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0100F4D00_2_0100F4D0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01010FD00_2_01010FD0
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_01021E500_2_01021E50
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0101DE700_2_0101DE70
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9A7700_2_00F9A770
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BB08908_2_00BB0890
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BB48E08_2_00BB48E0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C5A9308_2_00C5A930
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BA5A908_2_00BA5A90
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BABA608_2_00BABA60
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B8ABA08_2_00B8ABA0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BCDB808_2_00BCDB80
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BC03608_2_00BC0360
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BD33508_2_00BD3350
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BB8C908_2_00BB8C90
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C145E08_2_00C145E0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BB65908_2_00BB6590
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BA85708_2_00BA8570
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BADE708_2_00BADE70
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BB76608_2_00BB7660
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BB0FB08_2_00BB0FB0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BA07808_2_00BA0780
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BA47308_2_00BA4730
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BBA7008_2_00BBA700
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B8A7708_2_00B8A770
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BAA7608_2_00BAA760
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C608808_2_00C60880
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C640088_2_00C64008
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B820508_2_00B82050
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BF21708_2_00BF2170
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B9A1508_2_00B9A150
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C1D2C08_2_00C1D2C0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B822C08_2_00B822C0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BB02C08_2_00BB02C0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C69A4F8_2_00C69A4F
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C01A508_2_00C01A50
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C123608_2_00C12360
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C0BCC08_2_00C0BCC0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BFF4D08_2_00BFF4D0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C04D308_2_00C04D30
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C0D5308_2_00C0D530
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C0DE708_2_00C0DE70
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00BF07B08_2_00BF07B0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C00FD08_2_00C00FD0
                          Source: C:\Users\user\Desktop\file.exeCode function: String function: 00FF9C70 appears 36 times
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: String function: 00BE9C70 appears 32 times
                          Source: ladas[1].exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                          Source: ladas[1].exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                          Source: ladas[1].exe.8.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                          Source: file.exe, 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameMSBuild.exeR vs file.exe
                          Source: file.exe, 00000000.00000002.2980461301.0000000000F80000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMSBuild.exeR vs file.exe
                          Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: ntmarta.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: winhttp.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: mswsock.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: devobj.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: webio.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: iphlpapi.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: winnsi.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: dnsapi.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: rasadhlp.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: fwpuclnt.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: schannel.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: mskeyprotect.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: ntasn1.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: ncrypt.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: ncryptsslp.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: msasn1.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: cryptsp.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: rsaenh.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: cryptbase.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: gpapi.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: vaultcli.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: dpapi.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: linkinfo.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: ntshrui.dllJump to behavior
                          Source: C:\Users\user\Desktop\file.exeSection loaded: cscapi.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dpapi.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iertutil.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: urlmon.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: srvcli.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: netutils.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: propsys.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: edputil.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: appresolver.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: bcp47langs.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: slc.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sppc.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dpapi.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iertutil.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: profapi.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: urlmon.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: srvcli.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: netutils.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: propsys.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: edputil.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.staterepositoryps.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: appresolver.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: bcp47langs.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: slc.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: userenv.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sppc.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecorecommonproxystub.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecoreuapcommonproxystub.dll
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: apphelp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ondemandconnroutehelper.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: webio.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: iphlpapi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winnsi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dnsapi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rasadhlp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: fwpuclnt.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: schannel.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mskeyprotect.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncryptsslp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: msasn1.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptsp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rsaenh.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptbase.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: vaultcli.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wintypes.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: windows.storage.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wldp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntmarta.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: iertutil.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: profapi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: kernel.appcore.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ondemandconnroutehelper.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: urlmon.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: srvcli.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: netutils.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: uxtheme.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: propsys.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: edputil.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: windows.staterepositoryps.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wintypes.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: appresolver.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: bcp47langs.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: slc.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: userenv.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sppc.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: onecorecommonproxystub.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: onecoreuapcommonproxystub.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wsock32.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: version.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: winmm.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: mpr.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wininet.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: iphlpapi.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: userenv.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: uxtheme.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: kernel.appcore.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: windows.storage.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wldp.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: propsys.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: urlmon.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: iertutil.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: srvcli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: netutils.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: windows.shell.servicehostbuilder.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: onecoreuapcommonproxystub.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: ieframe.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: netapi32.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: winhttp.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wkscli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: windows.staterepositoryps.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: edputil.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: secur32.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: sspicli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: mlang.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: profapi.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: policymanager.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: msvcp110_win.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wintypes.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: onecorecommonproxystub.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: pcacli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: sfc_os.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: ieframe.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: netapi32.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: winhttp.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wkscli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: ieframe.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: netapi32.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: winhttp.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wkscli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: ieframe.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: netapi32.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: winhttp.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: wkscli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: appresolver.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: bcp47langs.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: slc.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeSection loaded: sppc.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ondemandconnroutehelper.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: webio.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: iphlpapi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winnsi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dnsapi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rasadhlp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: fwpuclnt.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: schannel.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mskeyprotect.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncryptsslp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: msasn1.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptsp.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rsaenh.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptbase.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: kernel.appcore.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                          Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: apphelp.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: acgenral.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: uxtheme.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmm.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: samcli.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: msacm32.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: version.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: userenv.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: dwmapi.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: urlmon.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: mpr.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sspicli.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: iertutil.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: srvcli.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: netutils.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: aclayers.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc_os.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: wininet.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: kernel.appcore.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: apphelp.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: acgenral.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: uxtheme.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmm.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: samcli.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: msacm32.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: version.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: userenv.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: dwmapi.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: urlmon.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: mpr.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sspicli.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: iertutil.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: srvcli.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: netutils.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: aclayers.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc_os.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: wininet.dll
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: kernel.appcore.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: apphelp.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: winmm.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: wininet.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: sspicli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: kernel.appcore.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: uxtheme.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: mstask.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: mstask.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: windows.storage.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: wldp.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: mpr.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: propsys.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: profapi.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: edputil.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: urlmon.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: iertutil.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: srvcli.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: netutils.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: windows.staterepositoryps.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: wintypes.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: appresolver.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: bcp47langs.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: slc.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: userenv.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: sppc.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: onecorecommonproxystub.dll
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSection loaded: onecoreuapcommonproxystub.dll
                          Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                          Source: file.exeStatic PE information: Section: ZLIB complexity 0.9994673295454546
                          Source: file.exeStatic PE information: Section: nlyzwaah ZLIB complexity 0.9910513154479383
                          Source: RageMP131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9994673295454546
                          Source: RageMP131.exe.0.drStatic PE information: Section: nlyzwaah ZLIB complexity 0.9910513154479383
                          Source: MPGPH131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9994673295454546
                          Source: MPGPH131.exe.0.drStatic PE information: Section: nlyzwaah ZLIB complexity 0.9910513154479383
                          Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9996970749728851
                          Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9966190732758621
                          Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.99484375
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: Section: ZLIB complexity 0.9996970749728851
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: Section: ZLIB complexity 0.9966190732758621
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: Section: ZLIB complexity 0.99484375
                          Source: ladas[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9999914336622807
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: Section: ZLIB complexity 0.9999914336622807
                          Source: EdgeMS131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: EdgeMS131.exe.0.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: niks[1].exe.0.drStatic PE information: Section: rgatmioc ZLIB complexity 0.9945738784195659
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: Section: rgatmioc ZLIB complexity 0.9945738784195659
                          Source: amert[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: amert[1].exe.0.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: Section: ZLIB complexity 0.9996970749728851
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: Section: ZLIB complexity 0.9966190732758621
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: Section: ZLIB complexity 0.99484375
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: Section: ZLIB complexity 0.9999914336622807
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: Section: rgatmioc ZLIB complexity 0.9945738784195659
                          Source: plaza[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9996970749728851
                          Source: plaza[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9966190732758621
                          Source: plaza[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.99484375
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: Section: ZLIB complexity 0.9996970749728851
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: Section: ZLIB complexity 0.9966190732758621
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: Section: ZLIB complexity 0.99484375
                          Source: ladas[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9999914336622807
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: Section: ZLIB complexity 0.9999914336622807
                          Source: amert[2].exe.7.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: amert[2].exe.7.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: niks[1].exe.7.drStatic PE information: Section: rgatmioc ZLIB complexity 0.9945738784195659
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: Section: rgatmioc ZLIB complexity 0.9945738784195659
                          Source: niks[1].exe.8.drStatic PE information: Section: rgatmioc ZLIB complexity 0.9945738784195659
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: Section: rgatmioc ZLIB complexity 0.9945738784195659
                          Source: plaza[1].exe.8.drStatic PE information: Section: ZLIB complexity 0.9996970749728851
                          Source: plaza[1].exe.8.drStatic PE information: Section: ZLIB complexity 0.9966190732758621
                          Source: plaza[1].exe.8.drStatic PE information: Section: ZLIB complexity 0.99484375
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: Section: ZLIB complexity 0.9996970749728851
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: Section: ZLIB complexity 0.9966190732758621
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: Section: ZLIB complexity 0.99484375
                          Source: ladas[1].exe.8.drStatic PE information: Section: ZLIB complexity 0.9999914336622807
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: Section: ZLIB complexity 0.9999914336622807
                          Source: amert[1].exe.8.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: amert[1].exe.8.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: Section: ZLIB complexity 0.9976917613636364
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: Section: wplfwedx ZLIB complexity 0.994152472892023
                          Source: ladas[1].exe.7.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                          Source: ladas[1].exe.8.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                          Source: ladas[1].exe.0.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                          Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@211/936@0/88
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B8ABA0 CreateToolhelp32Snapshot,8_2_00B8ABA0
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\RageMP131Jump to behavior
                          Source: C:\Windows\System32\SIHClient.exeMutant created: {376155FF-95A0-46CA-8F57-ACB09EA70153}
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8232:120:WilError_03
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:10008:120:WilError_03
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_03
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeMutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1672:120:WilError_03
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\rage131MP.tmpJump to behavior
                          Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                          Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
                          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
                          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
                          Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
                          Source: file.exe, 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1999562541.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2065812545.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2066983405.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2991732572.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2168758239.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2878089392.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.2360402306.0000000005230000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                          Source: file.exe, 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1999562541.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2065812545.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2066983405.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2991732572.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2168758239.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2878089392.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.2360402306.0000000005230000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                          Source: file.exe, 00000000.00000003.2113876416.0000000005C71000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2614228154.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2119322511.00000000009A5000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2116666400.0000000000977000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2650881553.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2322405219.0000000005C43000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2267645108.00000000005B2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2264457560.0000000005AD2000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2269803789.0000000005AD9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                          Source: file.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                          Source: RageMP131.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                          Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
                          Source: unknownProcess created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
                          Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
                          Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv oDBIuu78qUSLDogbPZYF5w.0.2
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe"
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=1964,i,5887355526268781908,1189009886419855111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1984,i,6749347610235560040,8445991958934204639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2020,i,9349519310739507833,11996823178141009930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1976,i,11539279321236040917,10474362654299226247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                          Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2080,i,6001142355176275865,11694759345999334586,262144 /prefetch:3
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST
                          Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=2028,i,4605008049051892939,13077336860849041403,262144 /prefetch:3
                          Source: unknownProcess created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                          Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1120 --field-trial-handle=2024,i,16006183332478894821,13298773514920591943,262144 /prefetch:3
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                          Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:3
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                          Source: unknownProcess created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                          Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe"
                          Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2164 -prefMapHandle 2156 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78885992-7c24-4bea-b4cd-80bc1adb5941} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fbfe16e710 socket
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6352 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8
                          Source: unknownProcess created: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe "C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe"
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3672 -childID 1 -isForBrowser -prefsHandle 1216 -prefMapHandle 3664 -prefsLen 21867 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe175a33-28a2-4047-aeec-757513839c5e} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8f78ca10 tab
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2556 -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 2968 -prefsLen 22057 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a7ce19a-c0e1-4606-ade3-f9e411e1fb00} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8b43cf50 tab
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHESTJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHESTJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe" Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHESTJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHESTJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe" Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv oDBIuu78qUSLDogbPZYF5w.0.2
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=1964,i,5887355526268781908,1189009886419855111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1984,i,6749347610235560040,8445991958934204639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2020,i,9349519310739507833,11996823178141009930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1976,i,11539279321236040917,10474362654299226247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2080,i,6001142355176275865,11694759345999334586,262144 /prefetch:3
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=2028,i,4605008049051892939,13077336860849041403,262144 /prefetch:3
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1120 --field-trial-handle=2024,i,16006183332478894821,13298773514920591943,262144 /prefetch:3
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:3
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6352 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2164 -prefMapHandle 2156 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78885992-7c24-4bea-b4cd-80bc1adb5941} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fbfe16e710 socket
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3672 -childID 1 -isForBrowser -prefsHandle 1216 -prefMapHandle 3664 -prefsLen 21867 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe175a33-28a2-4047-aeec-757513839c5e} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8f78ca10 tab
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2556 -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 2968 -prefsLen 22057 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a7ce19a-c0e1-4606-ade3-f9e411e1fb00} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8b43cf50 tab
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeProcess created: unknown unknown
                          Source: C:\Windows\System32\SIHClient.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07369A67-07A6-4608-ABEA-379491CB7C46}\InprocServer32
                          Source: EdgeMS131.lnk.0.drLNK file: ..\..\..\..\..\..\Local\Temp\EdgeMS131\EdgeMS131.exe
                          Source: Google Drive.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                          Source: YouTube.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                          Source: Sheets.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                          Source: Gmail.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                          Source: Slides.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                          Source: Docs.lnk.11.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                          Source: Window RecorderWindow detected: More than 3 window changes detected
                          Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                          Source: file.exeStatic file information: File size 2332672 > 1048576
                          Source: file.exeStatic PE information: Raw size of nlyzwaah is bigger than: 0x100000 < 0x1a5600

                          Data Obfuscation

                          barindex
                          Detected unpacking (changes PE section rights)
                          Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 0.2.file.exe.f90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nlyzwaah:EW;lkbejoib:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nlyzwaah:EW;lkbejoib:EW;.taggant:EW;
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 8.2.RageMP131.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nlyzwaah:EW;lkbejoib:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nlyzwaah:EW;lkbejoib:EW;.taggant:EW;
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 26.2.RageMP131.exe.b80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nlyzwaah:EW;lkbejoib:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nlyzwaah:EW;lkbejoib:EW;.taggant:EW;
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeUnpacked PE file: 33.2.MSIUpdaterV131.exe.650000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wplfwedx:EW;ykkhrrnz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wplfwedx:EW;ykkhrrnz:EW;.taggant:EW;
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeUnpacked PE file: 42.2.MSIUpdaterV131.exe.650000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wplfwedx:EW;ykkhrrnz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wplfwedx:EW;ykkhrrnz:EW;.taggant:EW;
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeUnpacked PE file: 44.2._z8_twA5gL3uyAKSYBl4.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wplfwedx:EW;ykkhrrnz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wplfwedx:EW;ykkhrrnz:EW;.taggant:EW;
                          Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                          Source: ladas[1].exe.7.drStatic PE information: real checksum: 0x2506c6 should be: 0x24cfda
                          Source: amert[1].exe.0.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: plaza[1].exe.7.drStatic PE information: real checksum: 0x0 should be: 0x2f2766
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: real checksum: 0x0 should be: 0x2f2766
                          Source: amert[2].exe.7.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: amert[1].exe.8.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: real checksum: 0x0 should be: 0x2f2766
                          Source: ladas[1].exe.8.drStatic PE information: real checksum: 0x2506c6 should be: 0x24cfda
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: real checksum: 0x2506c6 should be: 0x24cfda
                          Source: plaza[1].exe.8.drStatic PE information: real checksum: 0x0 should be: 0x2f2766
                          Source: plaza[1].exe.0.drStatic PE information: real checksum: 0x0 should be: 0x2f2766
                          Source: EdgeMS131.exe.0.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: file.exeStatic PE information: real checksum: 0x245d55 should be: 0x240507
                          Source: ladas[1].exe.0.drStatic PE information: real checksum: 0x2506c6 should be: 0x24cfda
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: real checksum: 0x0 should be: 0x2f2766
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: real checksum: 0x2506c6 should be: 0x24cfda
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: RageMP131.exe.0.drStatic PE information: real checksum: 0x245d55 should be: 0x240507
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: real checksum: 0x2506c6 should be: 0x24cfda
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x2f2766
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: real checksum: 0x2506c6 should be: 0x24cfda
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: MPGPH131.exe.0.drStatic PE information: real checksum: 0x245d55 should be: 0x240507
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: real checksum: 0x1d5591 should be: 0x1ce2cc
                          Source: file.exeStatic PE information: section name:
                          Source: file.exeStatic PE information: section name: .idata
                          Source: file.exeStatic PE information: section name:
                          Source: file.exeStatic PE information: section name: nlyzwaah
                          Source: file.exeStatic PE information: section name: lkbejoib
                          Source: file.exeStatic PE information: section name: .taggant
                          Source: RageMP131.exe.0.drStatic PE information: section name:
                          Source: RageMP131.exe.0.drStatic PE information: section name: .idata
                          Source: RageMP131.exe.0.drStatic PE information: section name:
                          Source: RageMP131.exe.0.drStatic PE information: section name: nlyzwaah
                          Source: RageMP131.exe.0.drStatic PE information: section name: lkbejoib
                          Source: RageMP131.exe.0.drStatic PE information: section name: .taggant
                          Source: MPGPH131.exe.0.drStatic PE information: section name:
                          Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
                          Source: MPGPH131.exe.0.drStatic PE information: section name:
                          Source: MPGPH131.exe.0.drStatic PE information: section name: nlyzwaah
                          Source: MPGPH131.exe.0.drStatic PE information: section name: lkbejoib
                          Source: MPGPH131.exe.0.drStatic PE information: section name: .taggant
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: plaza[1].exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name:
                          Source: ladas[1].exe.0.drStatic PE information: section name:
                          Source: ladas[1].exe.0.drStatic PE information: section name: .idata
                          Source: ladas[1].exe.0.drStatic PE information: section name:
                          Source: ladas[1].exe.0.drStatic PE information: section name: jsijvwkm
                          Source: ladas[1].exe.0.drStatic PE information: section name: qxzfqftw
                          Source: ladas[1].exe.0.drStatic PE information: section name: .taggant
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name:
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name: .idata
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name:
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name: jsijvwkm
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name: qxzfqftw
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name: .taggant
                          Source: EdgeMS131.exe.0.drStatic PE information: section name:
                          Source: EdgeMS131.exe.0.drStatic PE information: section name: .idata
                          Source: EdgeMS131.exe.0.drStatic PE information: section name:
                          Source: EdgeMS131.exe.0.drStatic PE information: section name: wplfwedx
                          Source: EdgeMS131.exe.0.drStatic PE information: section name: ykkhrrnz
                          Source: EdgeMS131.exe.0.drStatic PE information: section name: .taggant
                          Source: niks[1].exe.0.drStatic PE information: section name:
                          Source: niks[1].exe.0.drStatic PE information: section name: .idata
                          Source: niks[1].exe.0.drStatic PE information: section name:
                          Source: niks[1].exe.0.drStatic PE information: section name: rgatmioc
                          Source: niks[1].exe.0.drStatic PE information: section name: ibjqbcyw
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name:
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name: .idata
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name:
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name: rgatmioc
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name: ibjqbcyw
                          Source: amert[1].exe.0.drStatic PE information: section name:
                          Source: amert[1].exe.0.drStatic PE information: section name: .idata
                          Source: amert[1].exe.0.drStatic PE information: section name:
                          Source: amert[1].exe.0.drStatic PE information: section name: wplfwedx
                          Source: amert[1].exe.0.drStatic PE information: section name: ykkhrrnz
                          Source: amert[1].exe.0.drStatic PE information: section name: .taggant
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name:
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name: .idata
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name:
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name: wplfwedx
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name: ykkhrrnz
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name: .taggant
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: .idata
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: wplfwedx
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: ykkhrrnz
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: .taggant
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: .idata
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: wplfwedx
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: ykkhrrnz
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: .taggant
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name:
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name:
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name: .idata
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name:
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name: jsijvwkm
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name: qxzfqftw
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name: .taggant
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name:
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name: .idata
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name:
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name: wplfwedx
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name: ykkhrrnz
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name: .taggant
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name:
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name: .idata
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name:
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name: rgatmioc
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name: ibjqbcyw
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: plaza[1].exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name:
                          Source: ladas[1].exe.7.drStatic PE information: section name:
                          Source: ladas[1].exe.7.drStatic PE information: section name: .idata
                          Source: ladas[1].exe.7.drStatic PE information: section name:
                          Source: ladas[1].exe.7.drStatic PE information: section name: jsijvwkm
                          Source: ladas[1].exe.7.drStatic PE information: section name: qxzfqftw
                          Source: ladas[1].exe.7.drStatic PE information: section name: .taggant
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name:
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name: .idata
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name:
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name: jsijvwkm
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name: qxzfqftw
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name: .taggant
                          Source: amert[2].exe.7.drStatic PE information: section name:
                          Source: amert[2].exe.7.drStatic PE information: section name: .idata
                          Source: amert[2].exe.7.drStatic PE information: section name:
                          Source: amert[2].exe.7.drStatic PE information: section name: wplfwedx
                          Source: amert[2].exe.7.drStatic PE information: section name: ykkhrrnz
                          Source: amert[2].exe.7.drStatic PE information: section name: .taggant
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name:
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name: .idata
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name:
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name: wplfwedx
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name: ykkhrrnz
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name: .taggant
                          Source: niks[1].exe.7.drStatic PE information: section name:
                          Source: niks[1].exe.7.drStatic PE information: section name: .idata
                          Source: niks[1].exe.7.drStatic PE information: section name:
                          Source: niks[1].exe.7.drStatic PE information: section name: rgatmioc
                          Source: niks[1].exe.7.drStatic PE information: section name: ibjqbcyw
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name:
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name: .idata
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name:
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name: rgatmioc
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name: ibjqbcyw
                          Source: niks[1].exe.8.drStatic PE information: section name:
                          Source: niks[1].exe.8.drStatic PE information: section name: .idata
                          Source: niks[1].exe.8.drStatic PE information: section name:
                          Source: niks[1].exe.8.drStatic PE information: section name: rgatmioc
                          Source: niks[1].exe.8.drStatic PE information: section name: ibjqbcyw
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name:
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name: .idata
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name:
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name: rgatmioc
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name: ibjqbcyw
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: plaza[1].exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name:
                          Source: ladas[1].exe.8.drStatic PE information: section name:
                          Source: ladas[1].exe.8.drStatic PE information: section name: .idata
                          Source: ladas[1].exe.8.drStatic PE information: section name:
                          Source: ladas[1].exe.8.drStatic PE information: section name: jsijvwkm
                          Source: ladas[1].exe.8.drStatic PE information: section name: qxzfqftw
                          Source: ladas[1].exe.8.drStatic PE information: section name: .taggant
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name:
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name: .idata
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name:
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name: jsijvwkm
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name: qxzfqftw
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name: .taggant
                          Source: amert[1].exe.8.drStatic PE information: section name:
                          Source: amert[1].exe.8.drStatic PE information: section name: .idata
                          Source: amert[1].exe.8.drStatic PE information: section name:
                          Source: amert[1].exe.8.drStatic PE information: section name: wplfwedx
                          Source: amert[1].exe.8.drStatic PE information: section name: ykkhrrnz
                          Source: amert[1].exe.8.drStatic PE information: section name: .taggant
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name:
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name: .idata
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name:
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name: wplfwedx
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name: ykkhrrnz
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name: .taggant
                          Source: gmpopenh264.dll.tmp.41.drStatic PE information: section name: .rodata
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0106D638 push ecx; ret 0_2_0106D64B
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00CB1660 push ss; retf 8_2_00CB1676
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C5D638 push ecx; ret 8_2_00C5D64B
                          Source: file.exeStatic PE information: section name: entropy: 7.989426793160249
                          Source: file.exeStatic PE information: section name: nlyzwaah entropy: 7.9524435905525435
                          Source: RageMP131.exe.0.drStatic PE information: section name: entropy: 7.989426793160249
                          Source: RageMP131.exe.0.drStatic PE information: section name: nlyzwaah entropy: 7.9524435905525435
                          Source: MPGPH131.exe.0.drStatic PE information: section name: entropy: 7.989426793160249
                          Source: MPGPH131.exe.0.drStatic PE information: section name: nlyzwaah entropy: 7.9524435905525435
                          Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.999450655305451
                          Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.994986669725754
                          Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.318594193980733
                          Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.9862070793068245
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name: entropy: 7.999450655305451
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name: entropy: 7.994986669725754
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name: entropy: 7.318594193980733
                          Source: N6QvjPQDZQjnaZdnVBvT.exe.0.drStatic PE information: section name: entropy: 7.9862070793068245
                          Source: ladas[1].exe.0.drStatic PE information: section name: entropy: 7.98375592827691
                          Source: ladas[1].exe.0.drStatic PE information: section name: jsijvwkm entropy: 7.951241358317988
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name: entropy: 7.98375592827691
                          Source: MF0uP9gfhtzQk0nmPHvh.exe.0.drStatic PE information: section name: jsijvwkm entropy: 7.951241358317988
                          Source: EdgeMS131.exe.0.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: EdgeMS131.exe.0.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: niks[1].exe.0.drStatic PE information: section name: entropy: 7.743784611272952
                          Source: niks[1].exe.0.drStatic PE information: section name: rgatmioc entropy: 7.953140352640298
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name: entropy: 7.743784611272952
                          Source: Oqz1gKr60kpGbxg1Y8oi.exe.0.drStatic PE information: section name: rgatmioc entropy: 7.953140352640298
                          Source: amert[1].exe.0.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: amert[1].exe.0.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: _z8_twA5gL3uyAKSYBl4.exe.0.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name: entropy: 7.999450655305451
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name: entropy: 7.994986669725754
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name: entropy: 7.318594193980733
                          Source: SCqW_P_cJpDWINh51hrr.exe.6.drStatic PE information: section name: entropy: 7.9862070793068245
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name: entropy: 7.98375592827691
                          Source: Sc7F78Jv4MgkpAFnc7lD.exe.6.drStatic PE information: section name: jsijvwkm entropy: 7.951241358317988
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: tL_fuTzDWfh0VWCLkvvf.exe.6.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name: entropy: 7.743784611272952
                          Source: lraj6KX6dVjpCpYcPfhj.exe.6.drStatic PE information: section name: rgatmioc entropy: 7.953140352640298
                          Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.999450655305451
                          Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.994986669725754
                          Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.318594193980733
                          Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.9862070793068245
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name: entropy: 7.999450655305451
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name: entropy: 7.994986669725754
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name: entropy: 7.318594193980733
                          Source: 2fck4tppkbHBVDQlLEGf.exe.7.drStatic PE information: section name: entropy: 7.9862070793068245
                          Source: ladas[1].exe.7.drStatic PE information: section name: entropy: 7.98375592827691
                          Source: ladas[1].exe.7.drStatic PE information: section name: jsijvwkm entropy: 7.951241358317988
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name: entropy: 7.98375592827691
                          Source: Utp0jUqZeU8scbGMpad8.exe.7.drStatic PE information: section name: jsijvwkm entropy: 7.951241358317988
                          Source: amert[2].exe.7.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: amert[2].exe.7.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: vyOycan6EgXUKkno1qul.exe.7.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: niks[1].exe.7.drStatic PE information: section name: entropy: 7.743784611272952
                          Source: niks[1].exe.7.drStatic PE information: section name: rgatmioc entropy: 7.953140352640298
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name: entropy: 7.743784611272952
                          Source: ApPQmeGzxQP3KtH6lKvJ.exe.7.drStatic PE information: section name: rgatmioc entropy: 7.953140352640298
                          Source: niks[1].exe.8.drStatic PE information: section name: entropy: 7.743784611272952
                          Source: niks[1].exe.8.drStatic PE information: section name: rgatmioc entropy: 7.953140352640298
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name: entropy: 7.743784611272952
                          Source: pZpo0gU01Jxx21DdQmVG.exe.8.drStatic PE information: section name: rgatmioc entropy: 7.953140352640298
                          Source: plaza[1].exe.8.drStatic PE information: section name: entropy: 7.999450655305451
                          Source: plaza[1].exe.8.drStatic PE information: section name: entropy: 7.994986669725754
                          Source: plaza[1].exe.8.drStatic PE information: section name: entropy: 7.318594193980733
                          Source: plaza[1].exe.8.drStatic PE information: section name: entropy: 7.9862070793068245
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name: entropy: 7.999450655305451
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name: entropy: 7.994986669725754
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name: entropy: 7.318594193980733
                          Source: q38g6uHDrjZFvFdWaIY2.exe.8.drStatic PE information: section name: entropy: 7.9862070793068245
                          Source: ladas[1].exe.8.drStatic PE information: section name: entropy: 7.98375592827691
                          Source: ladas[1].exe.8.drStatic PE information: section name: jsijvwkm entropy: 7.951241358317988
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name: entropy: 7.98375592827691
                          Source: 3GOT3GAXnZqbKvGYOMGC.exe.8.drStatic PE information: section name: jsijvwkm entropy: 7.951241358317988
                          Source: amert[1].exe.8.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: amert[1].exe.8.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name: entropy: 7.982650862492596
                          Source: tTuIhXRskVqio6hWX3MJ.exe.8.drStatic PE information: section name: wplfwedx entropy: 7.953445492648589
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\niks[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\plaza[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\SCqW_P_cJpDWINh51hrr.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\ow5lYGAMAmmdqAMRBUVa.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\plaza[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\2fck4tppkbHBVDQlLEGf.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\vyOycan6EgXUKkno1qul.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\Utp0jUqZeU8scbGMpad8.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\niks[1].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\d34xW9C7tg9XChbetTr2.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[2].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\niks[1].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\well[1].exeJump to dropped file
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ladas[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\fu[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ladas[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\3JwuiAeAcxbhUfG4qx6Q.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\MF0uP9gfhtzQk0nmPHvh.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\3GOT3GAXnZqbKvGYOMGC.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\EdgeMS131\EdgeMS131.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\TrXOE37ZBs5VYYL1rLei.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[1].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\plaza[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\well[1].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\N6QvjPQDZQjnaZdnVBvT.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\ApPQmeGzxQP3KtH6lKvJ.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\Sc7F78Jv4MgkpAFnc7lD.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\tL_fuTzDWfh0VWCLkvvf.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\Oqz1gKr60kpGbxg1Y8oi.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\4cPGK95IIhu8co_GIahg.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\5Jv2cAGgCcc_tsdjHujY.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\FAB9iVvhMHF5ed7ylOId.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ladas[1].exeJump to dropped file
                          Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\pZpo0gU01Jxx21DdQmVG.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\amert[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\q38g6uHDrjZFvFdWaIY2.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\lraj6KX6dVjpCpYcPfhj.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\well[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\tTuIhXRskVqio6hWX3MJ.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[2].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeJump to dropped file

                          Boot Survival

                          barindex
                          Creates multiple autostart registry keys
                          Source: C:\Users\user\Desktop\file.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131Jump to behavior
                          Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonclassJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonclassJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                          Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonclassJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClassJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonclassJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonclassJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClass
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClass
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClass
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: Regmonclass
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: Filemonclass
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Filemonclass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Filemonclass
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: RegmonClass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: Regmonclass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: Filemonclass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: RegmonClass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: Regmonclass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: FilemonClass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: RegmonClass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: FilemonClass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: Regmonclass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: Filemonclass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                          Uses schtasks.exe or at.exe to add and modify task schedules
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnkJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeFile created: C:\Windows\Tasks\explorgu.job
                          Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnkJump to behavior
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
                          Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
                          Source: C:\Users\user\Desktop\file.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                          Source: C:\Users\user\Desktop\file.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                          Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeProcess information set: NOOPENFILEERRORBOX

                          Malware Analysis System Evasion

                          barindex
                          Tries to detect sandboxes / dynamic malware analysis system (registry check)
                          Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                          Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                          Tries to detect virtualization through RDTSC time measurements
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001237F2B second address: 0000000001237F3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001237F3C second address: 0000000001237F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF9E21CCEC6h 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001237F46 second address: 0000000001237F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001242F2A second address: 0000000001242F45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012431B7 second address: 00000000012431BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012431BB second address: 00000000012431DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF9E21CCED9h 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000124346C second address: 00000000012434AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FF9E07FDB83h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push ebx 0x0000000d jp 00007FF9E07FDB86h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF9E07FDB7Eh 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001243606 second address: 0000000001243624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCED1h 0x00000009 popad 0x0000000a ja 00007FF9E21CCECCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001243767 second address: 000000000124376C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000124376C second address: 000000000124378B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF9E21CCEC6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jc 00007FF9E21CCECEh 0x00000014 push esi 0x00000015 pop esi 0x00000016 jnl 00007FF9E21CCEC6h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000124378B second address: 00000000012437AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E07FDB7Ch 0x00000009 jmp 00007FF9E07FDB7Ah 0x0000000e popad 0x0000000f ja 00007FF9E07FDB7Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246C7B second address: 0000000001246CA8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF9E21CCEC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FF9E21CCED7h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246CA8 second address: 0000000001246CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246CAD second address: 0000000001246CB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246CB3 second address: 0000000001246CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246CB7 second address: 0000000001246CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF9E21CCED3h 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246CD6 second address: 0000000001246CDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246DA7 second address: 0000000001246DD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FF9E21CCED5h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246DD7 second address: 0000000001246DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246DDB second address: 0000000001246DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246DE5 second address: 0000000001246DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246DE9 second address: 0000000001246E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jno 00007FF9E21CCED3h 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007FF9E21CCECCh 0x0000001b jno 00007FF9E21CCEC6h 0x00000021 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246E17 second address: 0000000001246E41 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF9E07FDB78h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF9E07FDB88h 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FAB second address: 0000000001246FAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FAF second address: 0000000001246FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FB5 second address: 0000000001246FBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FBC second address: 0000000001246FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FF9E07FDB76h 0x00000015 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FD1 second address: 0000000001246FD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FD7 second address: 0000000001246FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FDD second address: 0000000001246FED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001246FED second address: 0000000001246FF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012470AB second address: 00000000012470AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012470AF second address: 0000000001247107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 688D97BAh 0x0000000e sub dword ptr [ebp+122D1AC7h], ebx 0x00000014 mov edi, dword ptr [ebp+122D395Fh] 0x0000001a lea ebx, dword ptr [ebp+1244AB30h] 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007FF9E07FDB78h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000018h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FF9E07FDB85h 0x00000042 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001247165 second address: 00000000012471BA instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF9E21CCED5h 0x00000008 jmp 00007FF9E21CCECFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov dword ptr [ebp+122D1AC7h], ebx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FF9E21CCEC8h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov esi, 0E444C28h 0x00000039 push 9E33A2B6h 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 push edx 0x00000042 pop edx 0x00000043 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012471BA second address: 00000000012471BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001258446 second address: 000000000125844F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000125844F second address: 0000000001258453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012670D1 second address: 00000000012670D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012670D8 second address: 00000000012670DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126544B second address: 000000000126549D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007FF9E21CCED8h 0x00000013 popad 0x00000014 jne 00007FF9E21CCEDEh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126549D second address: 00000000012654A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012655E1 second address: 00000000012655EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FF9E21CCEC6h 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012655EE second address: 000000000126560E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007FF9E07FDB76h 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001265B8D second address: 0000000001265B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001265B93 second address: 0000000001265B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001265B97 second address: 0000000001265BBD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF9E21CCEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FF9E21CCED7h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001265BBD second address: 0000000001265BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 jnp 00007FF9E07FDB88h 0x0000000c jl 00007FF9E07FDB78h 0x00000012 push esi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001265FDD second address: 0000000001265FE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000125E016 second address: 000000000125E01C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126674B second address: 0000000001266769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FF9E21CCEC6h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012668CF second address: 00000000012668D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012668D5 second address: 00000000012668DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012668DB second address: 00000000012668DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012668DF second address: 00000000012668E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012668E3 second address: 00000000012668F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FF9E07FDB76h 0x00000014 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012668F7 second address: 0000000001266907 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jg 00007FF9E21CCEC6h 0x0000000f pop ebx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001266BCA second address: 0000000001266BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001266BD0 second address: 0000000001266BEC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007FF9E21CCEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF9E21CCED0h 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001266BEC second address: 0000000001266BF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001266BF2 second address: 0000000001266BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001266F1B second address: 0000000001266F2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FF9E07FDB76h 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001266F2B second address: 0000000001266F35 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF9E21CCEC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001269CF3 second address: 0000000001269CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126A309 second address: 000000000126A30F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126A30F second address: 000000000126A313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126A412 second address: 000000000126A418 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126A418 second address: 000000000126A44C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF9E07FDB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jno 00007FF9E07FDB80h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF9E07FDB7Fh 0x00000020 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126A44C second address: 000000000126A452 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126A452 second address: 000000000126A458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126A458 second address: 000000000126A45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126B8EF second address: 000000000126B8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000126B8F4 second address: 000000000126B8F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001234961 second address: 000000000123496D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF9E07FDB76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000123496D second address: 000000000123497D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FF9E21CCECAh 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000123497D second address: 0000000001234981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001273806 second address: 0000000001273818 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jne 00007FF9E21CCEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001273818 second address: 000000000127381C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127381C second address: 0000000001273820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001273820 second address: 0000000001273830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FF9E07FDB76h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001273830 second address: 0000000001273834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001272D70 second address: 0000000001272D80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF9E07FDB76h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push ebx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001272EB5 second address: 0000000001272EC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001273413 second address: 000000000127341A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001275859 second address: 000000000127586C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127586C second address: 000000000127587B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF9E07FDB76h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012759FA second address: 0000000001275A00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001275A00 second address: 0000000001275A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001275BA2 second address: 0000000001275BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001275BA6 second address: 0000000001275BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001275BAC second address: 0000000001275BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001275BB2 second address: 0000000001275BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001275BB6 second address: 0000000001275BBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127602C second address: 0000000001276030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001276030 second address: 0000000001276036 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001276441 second address: 0000000001276445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001276445 second address: 000000000127644E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012774FC second address: 0000000001277506 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF9E07FDB7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012790FC second address: 0000000001279198 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF9E21CCEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c add dword ptr [ebp+122D1F6Eh], ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FF9E21CCEC8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e cld 0x0000002f call 00007FF9E21CCED6h 0x00000034 pushad 0x00000035 call 00007FF9E21CCECFh 0x0000003a pop esi 0x0000003b mov si, dx 0x0000003e popad 0x0000003f pop esi 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007FF9E21CCEC8h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 0000001Bh 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c mov dword ptr [ebp+12472727h], edi 0x00000062 and esi, dword ptr [ebp+1244A483h] 0x00000068 xchg eax, ebx 0x00000069 push edx 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001279B2C second address: 0000000001279B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127A6B6 second address: 000000000127A6C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127A6C0 second address: 000000000127A6C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127A6C4 second address: 000000000127A6C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127A6C8 second address: 000000000127A70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a ja 00007FF9E07FDB82h 0x00000010 push 00000000h 0x00000012 jnp 00007FF9E07FDB8Ah 0x00000018 xchg eax, ebx 0x00000019 jc 00007FF9E07FDB88h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127A70B second address: 000000000127A70F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127CA41 second address: 000000000127CA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007FF9E07FDB7Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF9E07FDB7Eh 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001239A1F second address: 0000000001239A36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001239A36 second address: 0000000001239A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF9E07FDB85h 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127D001 second address: 000000000127D08B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FF9E21CCEC8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FF9E21CCEC8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 clc 0x00000044 mov edi, dword ptr [ebp+122D1C3Eh] 0x0000004a push 00000000h 0x0000004c mov si, 00B1h 0x00000050 xchg eax, ebx 0x00000051 push edi 0x00000052 pushad 0x00000053 jnp 00007FF9E21CCEC6h 0x00000059 jnc 00007FF9E21CCEC6h 0x0000005f popad 0x00000060 pop edi 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FF9E21CCECBh 0x00000069 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127EF19 second address: 000000000127EF41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FF9E07FDB76h 0x00000011 je 00007FF9E07FDB76h 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127EF41 second address: 000000000127EF4B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF9E21CCEC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127EF4B second address: 000000000127EF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127EF55 second address: 000000000127EF5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127EF5F second address: 000000000127EF75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E07FDB82h 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001282FA3 second address: 0000000001282FA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001283E35 second address: 0000000001283E3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001285CB5 second address: 0000000001285CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001285CBB second address: 0000000001285CBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001287E68 second address: 0000000001287E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001285E60 second address: 0000000001285E66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001287E6C second address: 0000000001287F00 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF9E21CCEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FF9E21CCEC8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D27C2h], ebx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FF9E21CCEC8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 mov ebx, dword ptr [ebp+122D346Eh] 0x0000004f push 00000000h 0x00000051 push 00000000h 0x00000053 push edi 0x00000054 call 00007FF9E21CCEC8h 0x00000059 pop edi 0x0000005a mov dword ptr [esp+04h], edi 0x0000005e add dword ptr [esp+04h], 0000001Ch 0x00000066 inc edi 0x00000067 push edi 0x00000068 ret 0x00000069 pop edi 0x0000006a ret 0x0000006b mov edi, edx 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 push edx 0x00000071 jmp 00007FF9E21CCECCh 0x00000076 pop edx 0x00000077 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001285E66 second address: 0000000001285F0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push dword ptr fs:[00000000h] 0x00000013 mov edi, 5F30372Ah 0x00000018 push ebx 0x00000019 xor dword ptr [ebp+122D279Bh], ebx 0x0000001f pop ebx 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push edi 0x0000002a call 00007FF9E07FDB78h 0x0000002f pop edi 0x00000030 mov dword ptr [esp+04h], edi 0x00000034 add dword ptr [esp+04h], 00000018h 0x0000003c inc edi 0x0000003d push edi 0x0000003e ret 0x0000003f pop edi 0x00000040 ret 0x00000041 jp 00007FF9E07FDB80h 0x00000047 jmp 00007FF9E07FDB7Ah 0x0000004c sub ebx, dword ptr [ebp+122D1B1Dh] 0x00000052 mov eax, dword ptr [ebp+122D0DB9h] 0x00000058 jmp 00007FF9E07FDB7Eh 0x0000005d push FFFFFFFFh 0x0000005f push 00000000h 0x00000061 push ebx 0x00000062 call 00007FF9E07FDB78h 0x00000067 pop ebx 0x00000068 mov dword ptr [esp+04h], ebx 0x0000006c add dword ptr [esp+04h], 0000001Ah 0x00000074 inc ebx 0x00000075 push ebx 0x00000076 ret 0x00000077 pop ebx 0x00000078 ret 0x00000079 push eax 0x0000007a push ebx 0x0000007b push eax 0x0000007c push edx 0x0000007d jng 00007FF9E07FDB76h 0x00000083 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001285F0A second address: 0000000001285F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001288F61 second address: 0000000001288F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001288F65 second address: 0000000001288FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007FF9E21CCEC8h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push esi 0x00000027 call 00007FF9E21CCEC8h 0x0000002c pop esi 0x0000002d mov dword ptr [esp+04h], esi 0x00000031 add dword ptr [esp+04h], 00000018h 0x00000039 inc esi 0x0000003a push esi 0x0000003b ret 0x0000003c pop esi 0x0000003d ret 0x0000003e call 00007FF9E21CCED1h 0x00000043 mov di, D822h 0x00000047 pop ebx 0x00000048 push 00000000h 0x0000004a mov edi, dword ptr [ebp+122D3737h] 0x00000050 xchg eax, esi 0x00000051 jnl 00007FF9E21CCED0h 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FF9E21CCECEh 0x0000005f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001288FF0 second address: 0000000001288FF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001289266 second address: 0000000001289282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCED7h 0x00000009 popad 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128B1B6 second address: 000000000128B1BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128A25E second address: 000000000128A264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128B1BC second address: 000000000128B243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add dword ptr [ebp+122D1A40h], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FF9E07FDB78h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D26C5h], ecx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FF9E07FDB78h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000015h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f pushad 0x00000050 mov edx, dword ptr [ebp+122D38DBh] 0x00000056 call 00007FF9E07FDB83h 0x0000005b mov di, 9E9Fh 0x0000005f pop esi 0x00000060 popad 0x00000061 xchg eax, esi 0x00000062 push ebx 0x00000063 push eax 0x00000064 push edx 0x00000065 jbe 00007FF9E07FDB76h 0x0000006b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128A264 second address: 000000000128A268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128C370 second address: 000000000128C3CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007FF9E07FDB78h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 ja 00007FF9E07FDB76h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007FF9E07FDB78h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 mov di, DE85h 0x00000048 push 00000000h 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d jbe 00007FF9E07FDB7Ch 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128C3CD second address: 000000000128C3D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128C3D1 second address: 000000000128C3EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF9E07FDB7Eh 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128C3EC second address: 000000000128C3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128E296 second address: 000000000128E29C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128E29C second address: 000000000128E2A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FF9E21CCEC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128B416 second address: 000000000128B431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b jnp 00007FF9E07FDB7Eh 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129140C second address: 0000000001291424 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push edx 0x00000008 jmp 00007FF9E21CCECCh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001291424 second address: 000000000129142E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF9E07FDB76h 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128D4C0 second address: 000000000128D4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001291A49 second address: 0000000001291A4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128D4C6 second address: 000000000128D4CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128E47C second address: 000000000128E482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001291A4F second address: 0000000001291A53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001292AB2 second address: 0000000001292B09 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF9E07FDB78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FF9E07FDB78h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov edi, dword ptr [ebp+122D3883h] 0x0000002d push 00000000h 0x0000002f sub dword ptr [ebp+122D18B7h], ecx 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF9E07FDB82h 0x0000003f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001291CC4 second address: 0000000001291CD6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF9E21CCEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001292B09 second address: 0000000001292B13 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF9E07FDB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001291CD6 second address: 0000000001291CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001293ACD second address: 0000000001293AF7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF9E07FDB78h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f adc edi, 650BBA02h 0x00000015 push 00000000h 0x00000017 mov ebx, dword ptr [ebp+122D1B98h] 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jne 00007FF9E07FDB78h 0x00000028 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001295A3B second address: 0000000001295A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129BAA2 second address: 000000000129BAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129BAA6 second address: 000000000129BAAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A00C0 second address: 00000000012A00C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A00C8 second address: 00000000012A00CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A00CC second address: 00000000012A00D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129F6FD second address: 000000000129F728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF9E21CCECAh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007FF9E21CCECEh 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129F728 second address: 000000000129F768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF9E07FDB89h 0x00000008 jmp 00007FF9E07FDB7Eh 0x0000000d jmp 00007FF9E07FDB84h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129F768 second address: 000000000129F796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF9E21CCED4h 0x0000000c jmp 00007FF9E21CCED3h 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129FA51 second address: 000000000129FA64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E07FDB7Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129FA64 second address: 000000000129FA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129FA6C second address: 000000000129FA72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129FA72 second address: 000000000129FAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FF9E21CCED9h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FF9E21CCED4h 0x00000012 jmp 00007FF9E21CCECBh 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF9E21CCED3h 0x00000020 pushad 0x00000021 push edi 0x00000022 pop edi 0x00000023 pushad 0x00000024 popad 0x00000025 push esi 0x00000026 pop esi 0x00000027 popad 0x00000028 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129FAD1 second address: 000000000129FAD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000129FAD6 second address: 000000000129FADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A5026 second address: 00000000012A502A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A5158 second address: 00000000012A515C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A515C second address: 00000000012A517C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FF9E07FDB7Dh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A517C second address: 00000000012A5181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A5181 second address: 00000000012A51B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FF9E07FDB81h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e jmp 00007FF9E07FDB7Ch 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A9645 second address: 00000000012A9666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007FF9E21CCED6h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A9666 second address: 00000000012A9670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF9E07FDB76h 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A9670 second address: 00000000012A9684 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A97DB second address: 00000000012A97F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB86h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A97F5 second address: 00000000012A980B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FF9E21CCECCh 0x0000000f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A980B second address: 00000000012A9825 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007FF9E07FDB76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FF9E07FDB82h 0x00000012 ja 00007FF9E07FDB7Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012A9D90 second address: 00000000012A9DC4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF9E21CCEE7h 0x00000008 jmp 00007FF9E21CCED3h 0x0000000d jmp 00007FF9E21CCECEh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 jg 00007FF9E21CCECEh 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AF126 second address: 00000000012AF12C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AF12C second address: 00000000012AF13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCECEh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AF13E second address: 00000000012AF142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AF142 second address: 00000000012AF167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007FF9E21CCEC6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push ebx 0x00000018 js 00007FF9E21CCEC6h 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127F95E second address: 000000000127F970 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF9E07FDB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FF9E07FDB76h 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127F970 second address: 000000000125E016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007FF9E21CCEC6h 0x00000012 popad 0x00000013 pop edi 0x00000014 nop 0x00000015 pushad 0x00000016 add ebx, dword ptr [ebp+122D1B88h] 0x0000001c mov edx, dword ptr [ebp+122D319Ah] 0x00000022 popad 0x00000023 call dword ptr [ebp+12444CCFh] 0x00000029 pushad 0x0000002a push eax 0x0000002b jmp 00007FF9E21CCECBh 0x00000030 pop eax 0x00000031 push edx 0x00000032 push edi 0x00000033 pop edi 0x00000034 pop edx 0x00000035 pushad 0x00000036 push esi 0x00000037 pop esi 0x00000038 push ecx 0x00000039 pop ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127FF39 second address: 000000000127FF3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127FF3F second address: 000000000127FF43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127FF43 second address: 000000000127FF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 15291898h 0x0000000f add edi, dword ptr [ebp+122D346Eh] 0x00000015 jng 00007FF9E07FDB79h 0x0000001b mov dx, ax 0x0000001e call 00007FF9E07FDB79h 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127FF72 second address: 000000000127FFA4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FF9E21CCEC8h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 jmp 00007FF9E21CCED7h 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012800A0 second address: 00000000012800B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF9E07FDB7Eh 0x0000000f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000128012D second address: 0000000001280133 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001280133 second address: 0000000001280149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E07FDB82h 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012802CD second address: 00000000012802D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012804F3 second address: 00000000012804F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012804F8 second address: 00000000012804FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001280BAD second address: 0000000001280C60 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF9E07FDB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FF9E07FDB7Fh 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007FF9E07FDB84h 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FF9E07FDB78h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov dword ptr [ebp+1244A7F4h], esi 0x00000039 mov edx, dword ptr [ebp+122D3837h] 0x0000003f sub edi, dword ptr [ebp+122D3188h] 0x00000045 lea eax, dword ptr [ebp+1248366Fh] 0x0000004b push 00000000h 0x0000004d push esi 0x0000004e call 00007FF9E07FDB78h 0x00000053 pop esi 0x00000054 mov dword ptr [esp+04h], esi 0x00000058 add dword ptr [esp+04h], 0000001Dh 0x00000060 inc esi 0x00000061 push esi 0x00000062 ret 0x00000063 pop esi 0x00000064 ret 0x00000065 mov ecx, dword ptr [ebp+1244A4E2h] 0x0000006b mov cx, 2D72h 0x0000006f nop 0x00000070 jmp 00007FF9E07FDB7Ch 0x00000075 push eax 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 jc 00007FF9E07FDB76h 0x0000007f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001280C60 second address: 0000000001280C8C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 sub edx, dword ptr [ebp+12471DABh] 0x0000000e and dh, FFFFFF8Fh 0x00000011 lea eax, dword ptr [ebp+1248362Bh] 0x00000017 mov dword ptr [ebp+1244A938h], esi 0x0000001d sub dword ptr [ebp+1245C83Ah], ecx 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001280C8C second address: 0000000001280C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001280C92 second address: 0000000001280C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001280C96 second address: 0000000001280C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001280C9A second address: 0000000001280CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jnp 00007FF9E21CCEC6h 0x00000011 jmp 00007FF9E21CCED3h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AE240 second address: 00000000012AE256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E07FDB80h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AE256 second address: 00000000012AE283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF9E21CCEC6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d jmp 00007FF9E21CCED5h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 jne 00007FF9E21CCEC6h 0x0000001d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AE854 second address: 00000000012AE85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012AE9ED second address: 00000000012AE9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B3860 second address: 00000000012B3866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B3866 second address: 00000000012B386C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B386C second address: 00000000012B3871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B3871 second address: 00000000012B3884 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF9E21CCECAh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B3884 second address: 00000000012B388A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B388A second address: 00000000012B3897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B3897 second address: 00000000012B389D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B389D second address: 00000000012B38DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED2h 0x00000007 js 00007FF9E21CCEC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnl 00007FF9E21CCEE2h 0x00000015 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B3E3D second address: 00000000012B3E59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF9E07FDB87h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B418D second address: 00000000012B4199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007FF9E21CCEC6h 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B4199 second address: 00000000012B41A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jbe 00007FF9E07FDB76h 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B4473 second address: 00000000012B448C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E21CCED5h 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B4773 second address: 00000000012B4778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B4778 second address: 00000000012B477D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B477D second address: 00000000012B479C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF9E07FDB88h 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B479C second address: 00000000012B47C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FF9E21CCED7h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B47C0 second address: 00000000012B47C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012BB014 second address: 00000000012BB02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF9E21CCEC6h 0x0000000a jc 00007FF9E21CCEC6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012BB02B second address: 00000000012BB052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FF9E07FDB76h 0x00000011 jnp 00007FF9E07FDB76h 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9956 second address: 00000000012B9978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF9E21CCED0h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007FF9E21CCEC6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9AEC second address: 00000000012B9B02 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF9E07FDB76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnc 00007FF9E07FDB76h 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9B02 second address: 00000000012B9B0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF9E21CCEC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9B0E second address: 00000000012B9B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9B12 second address: 00000000012B9B30 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnc 00007FF9E21CCEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FF9E21CCECEh 0x00000015 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9B30 second address: 00000000012B9B34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9B34 second address: 00000000012B9B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9C8C second address: 00000000012B9CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF9E07FDB84h 0x0000000e rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9CA9 second address: 00000000012B9CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9CAF second address: 00000000012B9CD9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF9E07FDB8Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9CD9 second address: 00000000012B9CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9CDD second address: 00000000012B9CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012B9CE1 second address: 00000000012B9CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF9E21CCED5h 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012BA5D7 second address: 00000000012BA61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FF9E07FDB76h 0x0000000a popad 0x0000000b jne 00007FF9E07FDB7Ch 0x00000011 pushad 0x00000012 jmp 00007FF9E07FDB83h 0x00000017 jmp 00007FF9E07FDB88h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012BAA3F second address: 00000000012BAA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jmp 00007FF9E21CCED3h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012BAA60 second address: 00000000012BAA66 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012C30A5 second address: 00000000012C30B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCECDh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012C6411 second address: 00000000012C6415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012C6415 second address: 00000000012C641B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012C641B second address: 00000000012C6439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF9E07FDB88h 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012C6439 second address: 00000000012C6449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF9E21CCEC6h 0x0000000a jno 00007FF9E21CCEC6h 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012C5FDA second address: 00000000012C5FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA446 second address: 00000000012CA462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF9E21CCEC6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF9E21CCECFh 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA462 second address: 00000000012CA47B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB85h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA60C second address: 00000000012CA630 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED6h 0x00000007 jo 00007FF9E21CCEC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA630 second address: 00000000012CA634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA927 second address: 00000000012CA92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA92B second address: 00000000012CA930 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA930 second address: 00000000012CA949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF9E21CCEC6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jc 00007FF9E21CCEC6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA949 second address: 00000000012CA980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF9E07FDB76h 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007FF9E07FDB82h 0x00000011 jmp 00007FF9E07FDB80h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007FF9E07FDB76h 0x0000001f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CA980 second address: 00000000012CA984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CAAE2 second address: 00000000012CAAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CAAE8 second address: 00000000012CAAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007FF9E21CCEC6h 0x0000000c jne 00007FF9E21CCEC6h 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CAAFA second address: 00000000012CAB02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CE911 second address: 00000000012CE952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 je 00007FF9E21CCEC6h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FF9E21CCED9h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF9E21CCED6h 0x0000001c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012CEAD1 second address: 00000000012CEAF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF9E07FDB76h 0x00000009 jmp 00007FF9E07FDB81h 0x0000000e pushad 0x0000000f popad 0x00000010 jnl 00007FF9E07FDB76h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012D3505 second address: 00000000012D3528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FF9E21CCED4h 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007FF9E21CCEC6h 0x00000014 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012D3B05 second address: 00000000012D3B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DBD12 second address: 00000000012DBD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DBD19 second address: 00000000012DBD20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA073 second address: 00000000012DA078 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA078 second address: 00000000012DA091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FF9E07FDB7Dh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA091 second address: 00000000012DA0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jmp 00007FF9E21CCECDh 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA309 second address: 00000000012DA315 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF9E07FDB76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA315 second address: 00000000012DA32A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF9E21CCECCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA631 second address: 00000000012DA67A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB82h 0x00000007 jp 00007FF9E07FDB78h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF9E07FDB81h 0x00000016 jmp 00007FF9E07FDB88h 0x0000001b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA928 second address: 00000000012DA938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCECCh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DA938 second address: 00000000012DA93C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DAC28 second address: 00000000012DAC4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF9E21CCED8h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DAC4C second address: 00000000012DAC52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012DD328 second address: 00000000012DD33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FF9E21CCECEh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000123B591 second address: 000000000123B599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E106F second address: 00000000012E107D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF9E21CCEC8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E107D second address: 00000000012E1081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1221 second address: 00000000012E1225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1225 second address: 00000000012E122B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E122B second address: 00000000012E123F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF9E21CCEC8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FF9E21CCEC6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E123F second address: 00000000012E124F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1639 second address: 00000000012E1657 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FF9E21CCED2h 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E17E9 second address: 00000000012E17F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E17F4 second address: 00000000012E17F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1940 second address: 00000000012E194D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FF9E07FDB76h 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E194D second address: 00000000012E1951 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1A87 second address: 00000000012E1A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1A8B second address: 00000000012E1A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1C37 second address: 00000000012E1C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1C3D second address: 00000000012E1C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1C46 second address: 00000000012E1C4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1C4C second address: 00000000012E1C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1C58 second address: 00000000012E1C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E1C5C second address: 00000000012E1C6C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007FF9E21CCEE2h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E7E29 second address: 00000000012E7E2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012E7E2F second address: 00000000012E7E5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 jnp 00007FF9E21CCEC8h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012F044C second address: 00000000012F046F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Ah 0x00000007 jmp 00007FF9E07FDB80h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f push edx 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012F046F second address: 00000000012F0479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012EE599 second address: 00000000012EE59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012EE7B9 second address: 00000000012EE7E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF9E21CCED5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007FF9E21CCECEh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012EEC93 second address: 00000000012EECB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF9E07FDB87h 0x00000008 jns 00007FF9E07FDB76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012EEDFC second address: 00000000012EEE02 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012EF4EF second address: 00000000012EF4F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012EFC5B second address: 00000000012EFC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012F0316 second address: 00000000012F0325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FF9E07FDB76h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012EE18C second address: 00000000012EE1B1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF9E21CCECDh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b pushad 0x0000000c jmp 00007FF9E21CCECDh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012F4F2F second address: 00000000012F4F34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000012F7BD0 second address: 00000000012F7C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FF9E21CCECBh 0x0000000d popad 0x0000000e jmp 00007FF9E21CCED1h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FF9E21CCED1h 0x0000001a pushad 0x0000001b jmp 00007FF9E21CCECAh 0x00000020 pushad 0x00000021 popad 0x00000022 jmp 00007FF9E21CCED7h 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pop eax 0x0000002c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000130685B second address: 0000000001306879 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jne 00007FF9E07FDB7Eh 0x0000000d pushad 0x0000000e jne 00007FF9E07FDB76h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001306879 second address: 000000000130687F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001309049 second address: 0000000001309051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001309051 second address: 0000000001309056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000131AA82 second address: 000000000131AA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322AE0 second address: 0000000001322AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCECCh 0x00000009 jno 00007FF9E21CCEC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322AF8 second address: 0000000001322B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF9E07FDB81h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF9E07FDB88h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322B2A second address: 0000000001322B34 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF9E21CCEC6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322B34 second address: 0000000001322B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322B41 second address: 0000000001322B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322B45 second address: 0000000001322B64 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF9E07FDB76h 0x00000008 jmp 00007FF9E07FDB81h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322B64 second address: 0000000001322B70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FF9E21CCEC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322DD5 second address: 0000000001322DDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322F57 second address: 0000000001322F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF9E21CCECCh 0x0000000c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322F6A second address: 0000000001322F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322F6E second address: 0000000001322F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCED7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322F8B second address: 0000000001322FAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF9E07FDB87h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322FAA second address: 0000000001322FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001322FB0 second address: 0000000001322FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001337802 second address: 0000000001337823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FF9E21CCECEh 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FF9E21CCEC6h 0x00000012 jng 00007FF9E21CCEC6h 0x00000018 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000133FE84 second address: 000000000133FEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007FF9E07FDB76h 0x0000000c jbe 00007FF9E07FDB76h 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 js 00007FF9E07FDB76h 0x0000001c pop eax 0x0000001d pushad 0x0000001e jmp 00007FF9E07FDB81h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000134C856 second address: 000000000134C866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E21CCECCh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000013741CE second address: 00000000013741E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jp 00007FF9E07FDB76h 0x00000013 jnp 00007FF9E07FDB76h 0x00000019 popad 0x0000001a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000013741E8 second address: 00000000013741FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECFh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137314E second address: 0000000001373183 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF9E07FDB78h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FF9E07FDB80h 0x00000018 jmp 00007FF9E07FDB7Bh 0x0000001d jg 00007FF9E07FDB76h 0x00000023 popad 0x00000024 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000013732DD second address: 00000000013732E7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF9E21CCEC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000013732E7 second address: 00000000013732FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E07FDB82h 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000013732FD second address: 0000000001373301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137343A second address: 000000000137344E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 00000000013735F9 second address: 0000000001373615 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED6h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001373615 second address: 0000000001373629 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB80h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001373A6E second address: 0000000001373A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001373BBF second address: 0000000001373BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001373E91 second address: 0000000001373E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF9E21CCEC6h 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001373E9B second address: 0000000001373EA6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001376EF8 second address: 0000000001376EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000001379A57 second address: 0000000001379A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9E07FDB89h 0x00000009 popad 0x0000000a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137B671 second address: 000000000137B68A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF9E21CCED1h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137B68A second address: 000000000137B690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137B690 second address: 000000000137B694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137B694 second address: 000000000137B6D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007FF9E07FDB9Eh 0x0000000f jmp 00007FF9E07FDB86h 0x00000014 jmp 00007FF9E07FDB82h 0x00000019 ja 00007FF9E07FDB7Eh 0x0000001f push edi 0x00000020 pop edi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137B210 second address: 000000000137B226 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF9E21CCECEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137D1A5 second address: 000000000137D1AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137D1AB second address: 000000000137D1B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000137D1B1 second address: 000000000137D1CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Fh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FF9E07FDB76h 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D60899 second address: 0000000004D608BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D608BD second address: 0000000004D608C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D608C1 second address: 0000000004D608C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D608C5 second address: 0000000004D608CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D608CB second address: 0000000004D60905 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF9E21CCECBh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF9E21CCED5h 0x00000017 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D60905 second address: 0000000004D6090B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D301FD second address: 0000000004D3022F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FF9E21CCECCh 0x00000009 pop eax 0x0000000a popad 0x0000000b mov esi, edx 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007FF9E21CCED6h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D3022F second address: 0000000004D30234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D30234 second address: 0000000004D30239 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA075E second address: 0000000004DA0764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0764 second address: 0000000004DA0768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0768 second address: 0000000004DA0791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF9E07FDB7Eh 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0791 second address: 0000000004DA07A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA07A7 second address: 0000000004DA07AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA07AB second address: 0000000004DA07B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA07B1 second address: 0000000004DA0839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF9E07FDB88h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FF9E07FDB87h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FF9E07FDB7Bh 0x0000001c and al, 0000000Eh 0x0000001f jmp 00007FF9E07FDB89h 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007FF9E07FDB80h 0x0000002b xor esi, 4967E788h 0x00000031 jmp 00007FF9E07FDB7Bh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0839 second address: 0000000004DA083E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20D5A second address: 0000000004D20E63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF9E07FDB86h 0x00000009 jmp 00007FF9E07FDB85h 0x0000000e popfd 0x0000000f call 00007FF9E07FDB80h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ecx 0x00000019 pushad 0x0000001a push eax 0x0000001b mov si, bx 0x0000001e pop edx 0x0000001f mov dx, cx 0x00000022 popad 0x00000023 mov dword ptr [esp], ebp 0x00000026 jmp 00007FF9E07FDB7Eh 0x0000002b mov ebp, esp 0x0000002d jmp 00007FF9E07FDB80h 0x00000032 push dword ptr [ebp+04h] 0x00000035 pushad 0x00000036 call 00007FF9E07FDB7Eh 0x0000003b pushfd 0x0000003c jmp 00007FF9E07FDB82h 0x00000041 and ah, 00000028h 0x00000044 jmp 00007FF9E07FDB7Bh 0x00000049 popfd 0x0000004a pop ecx 0x0000004b pushfd 0x0000004c jmp 00007FF9E07FDB89h 0x00000051 adc cx, C546h 0x00000056 jmp 00007FF9E07FDB81h 0x0000005b popfd 0x0000005c popad 0x0000005d push dword ptr [ebp+0Ch] 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 movsx ebx, si 0x00000066 pushfd 0x00000067 jmp 00007FF9E07FDB84h 0x0000006c xor cx, 2518h 0x00000071 jmp 00007FF9E07FDB7Bh 0x00000076 popfd 0x00000077 popad 0x00000078 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20E63 second address: 0000000004D20E92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF9E21CCECDh 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20E92 second address: 0000000004D20E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20E98 second address: 0000000004D20E9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20E9C second address: 0000000004D20EA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20EB8 second address: 0000000004D20F09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF9E21CCECFh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF9E21CCED9h 0x0000000f jmp 00007FF9E21CCECBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF9E21CCED0h 0x00000022 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20F09 second address: 0000000004D20F0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20F0F second address: 0000000004D20F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D20F15 second address: 0000000004D20F19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA04BD second address: 0000000004DA04C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA04C3 second address: 0000000004DA04F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop esi 0x0000000f jmp 00007FF9E07FDB87h 0x00000014 popad 0x00000015 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA04F0 second address: 0000000004DA0549 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF9E21CCECFh 0x00000008 mov cx, 649Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FF9E21CCED5h 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FF9E21CCECEh 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF9E21CCED7h 0x00000024 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0549 second address: 0000000004DA0571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 1BA0170Ah 0x00000008 push edi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF9E07FDB88h 0x00000015 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70A8A second address: 0000000004D70ADE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF9E21CCED1h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF9E21CCED3h 0x00000017 sub si, 0F6Eh 0x0000001c jmp 00007FF9E21CCED9h 0x00000021 popfd 0x00000022 movzx eax, di 0x00000025 popad 0x00000026 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70ADE second address: 0000000004D70AFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF9E07FDB7Eh 0x00000011 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70AFD second address: 0000000004D70B5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3BC4h 0x00000007 mov si, di 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f call 00007FF9E21CCED5h 0x00000014 pushfd 0x00000015 jmp 00007FF9E21CCED0h 0x0000001a xor eax, 1615B7A8h 0x00000020 jmp 00007FF9E21CCECBh 0x00000025 popfd 0x00000026 pop eax 0x00000027 mov ax, bx 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d jmp 00007FF9E21CCECBh 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70B5D second address: 0000000004D70B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70B61 second address: 0000000004D70B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70B65 second address: 0000000004D70B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70B6B second address: 0000000004D70B88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E21CCED9h 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA05B9 second address: 0000000004DA05D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E07FDB88h 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA05D5 second address: 0000000004DA05D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA05D9 second address: 0000000004DA05F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF9E07FDB83h 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA05F7 second address: 0000000004DA0636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007FF9E21CCECAh 0x00000015 and ax, F8A8h 0x0000001a jmp 00007FF9E21CCECBh 0x0000001f popfd 0x00000020 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0636 second address: 0000000004DA063A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA063A second address: 0000000004DA0669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushfd 0x00000009 jmp 00007FF9E21CCED4h 0x0000000e add ecx, 1DF6EB08h 0x00000014 jmp 00007FF9E21CCECBh 0x00000019 popfd 0x0000001a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0669 second address: 0000000004DA069F instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov esi, edx 0x0000000d jmp 00007FF9E07FDB7Dh 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 call 00007FF9E07FDB83h 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA069F second address: 0000000004DA06A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA06A5 second address: 0000000004DA06A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0BE9 second address: 0000000004DA0C29 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF9E21CCED0h 0x00000008 sub esi, 21073618h 0x0000000e jmp 00007FF9E21CCECBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF9E21CCED5h 0x0000001f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0C29 second address: 0000000004DA0C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0C2F second address: 0000000004DA0C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0C33 second address: 0000000004DA0C80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007FF9E07FDB86h 0x00000012 mov eax, dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF9E07FDB87h 0x0000001c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0C80 second address: 0000000004DA0CB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c jmp 00007FF9E21CCECEh 0x00000011 and dword ptr [eax+04h], 00000000h 0x00000015 pushad 0x00000016 movzx eax, di 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0CB9 second address: 0000000004DA0CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF9E07FDB83h 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0CD9 second address: 0000000004DA0CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0CDF second address: 0000000004DA0CEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E07FDB7Bh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D709CE second address: 0000000004D709DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E21CCECCh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D709DE second address: 0000000004D70A03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov ax, 0489h 0x0000000e mov ax, 6045h 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 pushad 0x00000017 mov bx, si 0x0000001a mov ebx, ecx 0x0000001c popad 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70A03 second address: 0000000004D70A09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0EA1 second address: 0000000004DA0EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E07FDB7Eh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0EB3 second address: 0000000004DA0ECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0ECB second address: 0000000004DA0EE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0EE6 second address: 0000000004DA0F15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF9E21CCECFh 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f mov dx, ax 0x00000012 push eax 0x00000013 mov dx, C0FEh 0x00000017 pop ebx 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov si, dx 0x00000020 mov bx, 65AEh 0x00000024 popad 0x00000025 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0F15 second address: 0000000004DA0F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E07FDB7Bh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0F24 second address: 0000000004DA0F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D50819 second address: 0000000004D5081F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D5081F second address: 0000000004D50823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D50823 second address: 0000000004D50864 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 mov edx, esi 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FF9E07FDB7Dh 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007FF9E07FDB83h 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D50864 second address: 0000000004D50869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D50869 second address: 0000000004D50878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E07FDB7Bh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0C01 second address: 0000000004DB0C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 590AB49Eh 0x00000008 mov di, 7CAAh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF9E21CCECCh 0x00000017 jmp 00007FF9E21CCED5h 0x0000001c popfd 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0C39 second address: 0000000004DB0C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0C3D second address: 0000000004DB0C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0C41 second address: 0000000004DB0C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a jmp 00007FF9E07FDB88h 0x0000000f mov ebp, esp 0x00000011 jmp 00007FF9E07FDB80h 0x00000016 xchg eax, ecx 0x00000017 jmp 00007FF9E07FDB80h 0x0000001c push eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov cl, dl 0x00000022 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0C8C second address: 0000000004DB0CA0 instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, 70FF862Bh 0x0000000c popad 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0CA0 second address: 0000000004DB0CB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0CB3 second address: 0000000004DB0CCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 51DAh 0x00000007 mov di, B1A6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [76FA65FCh] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0CCC second address: 0000000004DB0CD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0CD2 second address: 0000000004DB0D19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 jmp 00007FF9E21CCED3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test eax, eax 0x0000000f jmp 00007FF9E21CCED6h 0x00000014 je 00007FFA5433FB27h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FF9E21CCECAh 0x00000023 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0D19 second address: 0000000004DB0D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0D1D second address: 0000000004DB0D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0D23 second address: 0000000004DB0D28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0D28 second address: 0000000004DB0D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ch, bl 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0D3B second address: 0000000004DB0D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0D41 second address: 0000000004DB0D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0D45 second address: 0000000004DB0D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FF9E07FDB83h 0x00000014 adc cx, C4FEh 0x00000019 jmp 00007FF9E07FDB89h 0x0000001e popfd 0x0000001f mov cx, 3D47h 0x00000023 popad 0x00000024 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB00C5 second address: 0000000004DB0174 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF9E21CCECFh 0x00000008 pop ecx 0x00000009 mov cl, dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FF9E21CCED1h 0x00000016 xor eax, 1F888D06h 0x0000001c jmp 00007FF9E21CCED1h 0x00000021 popfd 0x00000022 mov esi, 3D0678B7h 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FF9E21CCED8h 0x00000030 sbb si, 06D8h 0x00000035 jmp 00007FF9E21CCECBh 0x0000003a popfd 0x0000003b movzx ecx, di 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 pushad 0x00000042 mov ebx, 124A4AB4h 0x00000047 jmp 00007FF9E21CCECDh 0x0000004c popad 0x0000004d mov eax, dword ptr [ebp+08h] 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FF9E21CCED8h 0x00000059 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB0174 second address: 0000000004DB017A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DB017A second address: 0000000004DB018B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9E21CCECDh 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D7001F second address: 0000000004D70039 instructions: 0x00000000 rdtsc 0x00000002 mov dh, 38h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FF9E07FDB82h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70039 second address: 0000000004D7007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF9E21CCED3h 0x00000010 xor esi, 5CB0848Eh 0x00000016 jmp 00007FF9E21CCED9h 0x0000001b popfd 0x0000001c mov bx, ax 0x0000001f popad 0x00000020 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D7007B second address: 0000000004D7012E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 4EFD61EEh 0x00000008 mov al, dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov ecx, ebx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 jmp 00007FF9E07FDB85h 0x00000019 and esp, FFFFFFF8h 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FF9E07FDB7Ch 0x00000023 xor esi, 10ED7498h 0x00000029 jmp 00007FF9E07FDB7Bh 0x0000002e popfd 0x0000002f movzx ecx, bx 0x00000032 popad 0x00000033 push edx 0x00000034 jmp 00007FF9E07FDB80h 0x00000039 mov dword ptr [esp], ecx 0x0000003c pushad 0x0000003d mov cx, B80Dh 0x00000041 push ecx 0x00000042 mov di, 323Ch 0x00000046 pop ebx 0x00000047 popad 0x00000048 xchg eax, ebx 0x00000049 jmp 00007FF9E07FDB80h 0x0000004e push eax 0x0000004f pushad 0x00000050 mov ebx, 53F4D304h 0x00000055 mov cx, di 0x00000058 popad 0x00000059 xchg eax, ebx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d pushfd 0x0000005e jmp 00007FF9E07FDB80h 0x00000063 and al, FFFFFFB8h 0x00000066 jmp 00007FF9E07FDB7Bh 0x0000006b popfd 0x0000006c mov bh, al 0x0000006e popad 0x0000006f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D7012E second address: 0000000004D7014B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCED2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D7014B second address: 0000000004D70193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushfd 0x00000006 jmp 00007FF9E07FDB88h 0x0000000b sub ax, A878h 0x00000010 jmp 00007FF9E07FDB7Bh 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF9E07FDB85h 0x0000001f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70193 second address: 0000000004D701E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF9E21CCECAh 0x00000009 sub ecx, 04F39208h 0x0000000f jmp 00007FF9E21CCECBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 jmp 00007FF9E21CCED9h 0x0000001e xchg eax, esi 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF9E21CCECDh 0x00000026 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D701E0 second address: 0000000004D702E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF9E07FDB87h 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, dword ptr [ebp+08h] 0x00000011 jmp 00007FF9E07FDB85h 0x00000016 xchg eax, edi 0x00000017 jmp 00007FF9E07FDB7Eh 0x0000001c push eax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FF9E07FDB81h 0x00000024 xor eax, 50405146h 0x0000002a jmp 00007FF9E07FDB81h 0x0000002f popfd 0x00000030 mov ah, D7h 0x00000032 popad 0x00000033 xchg eax, edi 0x00000034 pushad 0x00000035 call 00007FF9E07FDB89h 0x0000003a pushfd 0x0000003b jmp 00007FF9E07FDB80h 0x00000040 sub cl, 00000048h 0x00000043 jmp 00007FF9E07FDB7Bh 0x00000048 popfd 0x00000049 pop eax 0x0000004a mov bx, 028Ch 0x0000004e popad 0x0000004f test esi, esi 0x00000051 jmp 00007FF9E07FDB7Bh 0x00000056 je 00007FFA529ABEE7h 0x0000005c jmp 00007FF9E07FDB86h 0x00000061 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000068 pushad 0x00000069 mov cx, CB6Dh 0x0000006d mov ah, B1h 0x0000006f popad 0x00000070 je 00007FFA529ABED2h 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007FF9E07FDB80h 0x0000007d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D702E7 second address: 0000000004D70359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c jmp 00007FF9E21CCED6h 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 jmp 00007FF9E21CCED0h 0x00000019 test edx, 61000000h 0x0000001f jmp 00007FF9E21CCED0h 0x00000024 jne 00007FFA5437B216h 0x0000002a pushad 0x0000002b mov esi, 1313C60Dh 0x00000030 jmp 00007FF9E21CCECAh 0x00000035 popad 0x00000036 test byte ptr [esi+48h], 00000001h 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70359 second address: 0000000004D7035D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D7035D second address: 0000000004D70363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D70363 second address: 0000000004D703B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FFA529ABEABh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FF9E07FDB86h 0x00000016 sbb ax, A9B8h 0x0000001b jmp 00007FF9E07FDB7Bh 0x00000020 popfd 0x00000021 movzx eax, di 0x00000024 popad 0x00000025 test bl, 00000007h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FF9E07FDB7Eh 0x0000002f rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8000E second address: 0000000004D80014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80014 second address: 0000000004D80018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80018 second address: 0000000004D8003B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF9E21CCECDh 0x00000013 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8003B second address: 0000000004D8009C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, D9h 0x00000005 jmp 00007FF9E07FDB88h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FF9E07FDB7Bh 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FF9E07FDB86h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bl, 36h 0x00000020 jmp 00007FF9E07FDB86h 0x00000025 popad 0x00000026 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8009C second address: 0000000004D80122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007FF9E21CCED6h 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 pushad 0x00000014 mov eax, 309AEF33h 0x00000019 pushfd 0x0000001a jmp 00007FF9E21CCED8h 0x0000001f and ax, 4B38h 0x00000024 jmp 00007FF9E21CCECBh 0x00000029 popfd 0x0000002a popad 0x0000002b jmp 00007FF9E21CCED8h 0x00000030 popad 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FF9E21CCECDh 0x0000003b rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80122 second address: 0000000004D80128 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80128 second address: 0000000004D80172 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushfd 0x00000010 jmp 00007FF9E21CCED3h 0x00000015 xor ax, 3BBEh 0x0000001a jmp 00007FF9E21CCED9h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80172 second address: 0000000004D80210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FF9E07FDB7Eh 0x0000000f push eax 0x00000010 jmp 00007FF9E07FDB7Bh 0x00000015 xchg eax, esi 0x00000016 pushad 0x00000017 movzx eax, bx 0x0000001a popad 0x0000001b mov esi, dword ptr [ebp+08h] 0x0000001e jmp 00007FF9E07FDB7Ah 0x00000023 sub ebx, ebx 0x00000025 pushad 0x00000026 push edi 0x00000027 pop eax 0x00000028 push edx 0x00000029 mov eax, 257F7851h 0x0000002e pop ecx 0x0000002f popad 0x00000030 test esi, esi 0x00000032 jmp 00007FF9E07FDB7Dh 0x00000037 je 00007FFA52993D33h 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 pushfd 0x00000041 jmp 00007FF9E07FDB83h 0x00000046 sbb ax, 65EEh 0x0000004b jmp 00007FF9E07FDB89h 0x00000050 popfd 0x00000051 mov dh, ch 0x00000053 popad 0x00000054 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80210 second address: 0000000004D80296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF9E21CCED8h 0x00000009 sub al, FFFFFF98h 0x0000000c jmp 00007FF9E21CCECBh 0x00000011 popfd 0x00000012 push esi 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001e jmp 00007FF9E21CCED2h 0x00000023 mov ecx, esi 0x00000025 jmp 00007FF9E21CCED0h 0x0000002a je 00007FFA54362FFEh 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FF9E21CCECEh 0x00000037 sub esi, 6D985D58h 0x0000003d jmp 00007FF9E21CCECBh 0x00000042 popfd 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80296 second address: 0000000004D802EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 test byte ptr [76FA6968h], 00000002h 0x0000000f pushad 0x00000010 jmp 00007FF9E07FDB83h 0x00000015 popad 0x00000016 jne 00007FFA52993C72h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FF9E07FDB7Bh 0x00000025 and ax, C17Eh 0x0000002a jmp 00007FF9E07FDB89h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D802EF second address: 0000000004D802F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D802F5 second address: 0000000004D802F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D802F9 second address: 0000000004D802FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D802FD second address: 0000000004D8033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007FF9E07FDB82h 0x00000010 xchg eax, ebx 0x00000011 jmp 00007FF9E07FDB80h 0x00000016 push eax 0x00000017 jmp 00007FF9E07FDB7Bh 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8033C second address: 0000000004D80345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop edi 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80345 second address: 0000000004D8039D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edx, 132A0C80h 0x00000013 pushfd 0x00000014 jmp 00007FF9E07FDB89h 0x00000019 xor cx, 3286h 0x0000001e jmp 00007FF9E07FDB81h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8039D second address: 0000000004D803A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D803A3 second address: 0000000004D803C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov al, bl 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8041E second address: 0000000004D80452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, DEC7h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d jmp 00007FF9E21CCED8h 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF9E21CCECAh 0x0000001c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80452 second address: 0000000004D80461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80461 second address: 0000000004D80467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80467 second address: 0000000004D8046B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8046B second address: 0000000004D804A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esp, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF9E21CCECDh 0x00000011 sub eax, 718B0176h 0x00000017 jmp 00007FF9E21CCED1h 0x0000001c popfd 0x0000001d mov esi, 10987867h 0x00000022 popad 0x00000023 pop ebp 0x00000024 pushad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE17B1 second address: 0000000004DE17B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE17B7 second address: 0000000004DE1811 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FF9E21CCED6h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FF9E21CCECDh 0x00000017 adc ecx, 13362446h 0x0000001d jmp 00007FF9E21CCED1h 0x00000022 popfd 0x00000023 popad 0x00000024 push 0000007Fh 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FF9E21CCECDh 0x0000002d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE1811 second address: 0000000004DE1854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000001h 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF9E07FDB7Ch 0x00000012 xor ax, 8B48h 0x00000017 jmp 00007FF9E07FDB7Bh 0x0000001c popfd 0x0000001d movzx eax, dx 0x00000020 popad 0x00000021 push dword ptr [ebp+08h] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov al, FBh 0x00000029 popad 0x0000002a rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE1854 second address: 0000000004DE185A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE185A second address: 0000000004DE185E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE185E second address: 0000000004DE1862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE1888 second address: 0000000004DE188C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE188C second address: 0000000004DE1892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE1892 second address: 0000000004DE1898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE1898 second address: 0000000004DE189C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE189C second address: 0000000004DE18A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DE18A0 second address: 0000000004DE17B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 jmp 00007FF9E21CCED2h 0x0000000e retn 0004h 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 push eax 0x00000015 call ebx 0x00000017 mov edi, edi 0x00000019 jmp 00007FF9E21CCED0h 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 mov edi, ecx 0x00000022 mov dx, ax 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a jmp 00007FF9E21CCED0h 0x0000002f call 00007FF9E21CCED2h 0x00000034 pop ecx 0x00000035 popad 0x00000036 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 000000000127D920 second address: 000000000127D924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DA0915 second address: 0000000004DA091B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80614 second address: 0000000004D80623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E07FDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80623 second address: 0000000004D80658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF9E21CCED5h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007FF9E21CCECEh 0x00000014 pop ebp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov ax, 56A3h 0x0000001c rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D80658 second address: 0000000004D8065C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004D8065C second address: 0000000004D80665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0D02 second address: 0000000004DF0D46 instructions: 0x00000000 rdtsc 0x00000002 mov ax, EB53h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c mov di, B066h 0x00000010 pop edi 0x00000011 mov bl, al 0x00000013 popad 0x00000014 push eax 0x00000015 jmp 00007FF9E07FDB86h 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FF9E07FDB80h 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0D46 second address: 0000000004DF0D4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0D4C second address: 0000000004DF0D74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FF9E07FDB80h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push dword ptr [ebp+0Ch] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov esi, 40C03E29h 0x00000019 movzx eax, di 0x0000001c popad 0x0000001d rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0D74 second address: 0000000004DF0D9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 pushfd 0x00000006 jmp 00007FF9E21CCECAh 0x0000000b sub ch, FFFFFFF8h 0x0000000e jmp 00007FF9E21CCECBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0D9F second address: 0000000004DF0DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0DA3 second address: 0000000004DF0DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0DA7 second address: 0000000004DF0DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0DAD second address: 0000000004DF0E3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9E21CCECAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FF9E21CCEC9h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 mov edi, esi 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007FF9E21CCECBh 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 pushad 0x00000021 mov ebx, 503AA12Ah 0x00000026 pushfd 0x00000027 jmp 00007FF9E21CCECBh 0x0000002c xor esi, 2E7B7DCEh 0x00000032 jmp 00007FF9E21CCED9h 0x00000037 popfd 0x00000038 popad 0x00000039 mov eax, dword ptr [eax] 0x0000003b jmp 00007FF9E21CCED1h 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 pushad 0x00000045 push ebx 0x00000046 jmp 00007FF9E21CCECAh 0x0000004b pop eax 0x0000004c mov al, dl 0x0000004e popad 0x0000004f pop eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0E3D second address: 0000000004DF0E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                          Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 0000000004DF0E41 second address: 0000000004DF0E45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                          Tries to evade debugger and weak emulator (self modifying code)
                          Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 00000000010CF9B7 instructions caused by: Self-modifying code
                          Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 00000000010CF9E5 instructions caused by: Self-modifying code
                          Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 00000000012689B2 instructions caused by: Self-modifying code
                          Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 000000000129BAD8 instructions caused by: Self-modifying code
                          Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 00000000012F9717 instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 0000000000EAF9B7 instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 0000000000EAF9E5 instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000010489B2 instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 000000000107BAD8 instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000010D9717 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000CBF9B7 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000CBF9E5 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000E589B2 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000E8BAD8 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000EE9717 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSpecial instruction interceptor: First address: 0000000000D0BB45 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSpecial instruction interceptor: First address: 0000000000EA6008 instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSpecial instruction interceptor: First address: 0000000000EA4F4C instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeSpecial instruction interceptor: First address: 0000000000F34E5A instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 00000000006BBB45 instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 0000000000856008 instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 0000000000854F4C instructions caused by: Self-modifying code
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 00000000008E4E5A instructions caused by: Self-modifying code
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_04D00CD4 rdtsc 0_2_04D00CD4
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 877Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1494Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1190Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1165Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1380Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1154Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1521Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 425
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1069
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1195
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1165
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1149
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1215
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1168
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1197
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeWindow / User API: threadDelayed 4893
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\niks[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\3GOT3GAXnZqbKvGYOMGC.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\plaza[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\SCqW_P_cJpDWINh51hrr.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\TrXOE37ZBs5VYYL1rLei.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\plaza[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\plaza[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\well[1].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\N6QvjPQDZQjnaZdnVBvT.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\ApPQmeGzxQP3KtH6lKvJ.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\2fck4tppkbHBVDQlLEGf.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\Sc7F78Jv4MgkpAFnc7lD.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\4cPGK95IIhu8co_GIahg.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\Oqz1gKr60kpGbxg1Y8oi.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\niks[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\Utp0jUqZeU8scbGMpad8.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\d34xW9C7tg9XChbetTr2.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ladas[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\niks[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\pZpo0gU01Jxx21DdQmVG.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\well[1].exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ladas[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ladas[1].exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\q38g6uHDrjZFvFdWaIY2.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\3JwuiAeAcxbhUfG4qx6Q.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\MF0uP9gfhtzQk0nmPHvh.exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\well[1].exeJump to dropped file
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\lraj6KX6dVjpCpYcPfhj.exeJump to dropped file
                          Source: C:\Users\user\Desktop\file.exeEvasive API call chain: RegOpenKey,DecisionNodes,ExitProcessgraph_0-72294
                          Source: C:\Users\user\Desktop\file.exe TID: 2360Thread sleep time: -30015s >= -30000sJump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 2584Thread sleep time: -44000s >= -30000sJump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 4984Thread sleep count: 92 > 30Jump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 3528Thread sleep time: -58029s >= -30000sJump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 4984Thread sleep count: 77 > 30Jump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 2972Thread sleep count: 33 > 30Jump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 2972Thread sleep time: -66033s >= -30000sJump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 3716Thread sleep time: -42021s >= -30000sJump to behavior
                          Source: C:\Users\user\Desktop\file.exe TID: 5824Thread sleep time: -52026s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5788Thread sleep count: 877 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5788Thread sleep time: -1754877s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3496Thread sleep count: 1494 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3496Thread sleep time: -2989494s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7268Thread sleep time: -48000s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6476Thread sleep count: 32 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3172Thread sleep count: 1190 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3172Thread sleep time: -2381190s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4284Thread sleep count: 228 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4284Thread sleep time: -456228s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6380Thread sleep count: 1165 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6380Thread sleep time: -2331165s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2468Thread sleep count: 1380 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2468Thread sleep time: -2761380s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4432Thread sleep count: 1154 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4432Thread sleep time: -2309154s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3576Thread sleep count: 1521 > 30Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3576Thread sleep time: -3043521s >= -30000sJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7196Thread sleep count: 425 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7196Thread sleep time: -850425s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5560Thread sleep count: 1069 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5560Thread sleep time: -2139069s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7272Thread sleep time: -56000s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7184Thread sleep count: 1195 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7184Thread sleep time: -2391195s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7172Thread sleep count: 1165 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7172Thread sleep time: -2331165s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7188Thread sleep count: 1149 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7188Thread sleep time: -2299149s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7180Thread sleep count: 1215 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7180Thread sleep time: -2431215s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7176Thread sleep count: 1168 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7176Thread sleep time: -2337168s >= -30000s
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7192Thread sleep count: 1197 > 30
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7192Thread sleep time: -2395197s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7508Thread sleep time: -44022s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7512Thread sleep time: -32016s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7700Thread sleep time: -44000s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7420Thread sleep count: 42 > 30
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7520Thread sleep time: -46023s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7516Thread sleep time: -44022s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7528Thread sleep time: -44022s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7524Thread sleep time: -42021s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7532Thread sleep time: -32016s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7536Thread sleep time: -36018s >= -30000s
                          Source: C:\Windows\System32\SIHClient.exe TID: 7768Thread sleep time: -30000s >= -30000s
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe TID: 7812Thread sleep time: -48930s >= -30000s
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 9420Thread sleep count: 104 > 30
                          Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                          Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeLast function: Thread delayed
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeLast function: Thread delayed
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeThread sleep count: Count: 4893 delay: -10
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00F9C050 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,0_2_00F9C050
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0106B4E5 FindFirstFileExW,0_2_0106B4E5
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B8C050 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,8_2_00B8C050
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00C5B4E5 recv,FindFirstFileExW,8_2_00C5B4E5
                          Source: MPGPH131.exe, 00000006.00000003.2085905258.00000000005F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}J
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: formVMware20,11696428655
                          Source: RageMP131.exe, 00000008.00000002.2980143223.000000000050F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,116p
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696H
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2976955927.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000002.2893638622.0000020573A07000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000003.2576373237.00000205739B5000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000002.2893638622.00000205739B5000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000003.2576373237.0000020573A07000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000003.2565092652.00000205739B5000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000003.2185170867.0000020573A07000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001461000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5
                          Source: RageMP131.exe, 00000008.00000003.2190955161.0000000000523000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                          Source: RageMP131.exe, 00000008.00000002.3051142522.0000000005AD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}438029,ijd96734:409016,1c484819:413463,0188i430:410947,74g97287:426089,3cej0868:387697,bi4f4994:450434,j4d0f649:415920,be37a759:398467,9cc60973:411866,downarrowscrollwithtriggernew:379502,nonfloatingwithouttoggle:430356,f7bdg612:421301,d78jg254:440485,60a06606:446395,e8455899:433611,ed254:256435,a5g3j174:427088,domexpansion_v1:408272,sidepanecashbackclickv1:392715,ed429:371711,savingsyesui:360239,0iie5378:378326,j3jdi477:407165,g9744299:382390,0ce12802:395899,ed0317:378541,e5097847:376095,d699f664:417781,v1_newnotificationsettingsu:371743,13gjf650:361709,2chfa640:363442,edse218:361564,i5ceh755:348150,pcproductbyregexenus:345020,2ae48381:440529,i4d2e897:416850,0cdi8526:390116,158hf900:358403,edpas404:384675,followablewebwpo:339322,1ebea465:393468,72dhd990:347218,b5691989:400307,v11_aocgroups2and3:393492,d8ej1711:320853,edtok960:350910,deepeelogging1:296539,etreeapiv15:300838,hjd07315:315108,6fh95461:311640,gserpas:292001,edenh823:312573,i8id9958:449025,923e2685:283690,2fche262:263263,v1_onlineselextraction:330872,externalmidrange3:261503,htmlfragmentcollectionv1:285601,edklo447:358232,designershoreline-215:384841,edweb468:191638,ed672:193569,linkui:417512,ededg840:189491","EdgeConfig":"P-R-1141099-1-3,P-R-1136586-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1132367-1-7,P-R-1132544-1-6,P-R-1132175-1-3,P-R-1130507-1-5,P-R-1113531-4-9,P-R-1108562-1-7,P-R-1103742-4-6,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1095721-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-25,P-R-1080066-1-13,P-R-1077170-1-3,P-R-1060324-1-5,P-R-1052391-1-8,P-R-1039913-1-16,P-R-1036635-2-5,P-R-110491-23-70,P-R-68474-9-12,P-R-61206-14-17,P-R-61153-10-15,P-R-45373-8-85,P-R-46265-41-100","EdgeDomainActions":"P-R-1093245-1-12,P-R-1037936-1-9,P-R-1024693-1-9,P-R-108604-1-34,P-R-78
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,1169642865
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: r global passwords blocklistVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,11696428655
                          Source: RageMP131.exe, 00000008.00000002.2980143223.000000000050F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696428655o
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696428655t
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696428655
                          Source: RageMP131.exe, 0000001A.00000003.2423709938.0000000001461000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}a
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001461000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_diw
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
                          Source: firefox.exe, 00000029.00000003.2299483431.000001FB805A5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2301349556.000001FB805A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWPl_
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ra Change Transaction PasswordVMware20,11696428655
                          Source: file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBnl
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o.inVMware20,11696428655~
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696428655x
                          Source: MPGPH131.exe, 00000006.00000003.2085905258.00000000005F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}u
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
                          Source: file.exe, file.exe, 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmp, RageMP131.exe, RageMP131.exe, 00000008.00000002.2994677119.0000000000E3D000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000002.2884459256.0000000000E3D000.00000040.00000001.01000000.00000006.sdmp, MSIUpdaterV131.exe, 00000021.00000002.2978192451.0000000000838000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
                          Source: file.exe, 00000000.00000002.2976955927.00000000008F2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696428655f
                          Source: RageMP131.exe, 0000001A.00000003.2423709938.0000000001459000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428
                          Source: MPGPH131.exe, 00000007.00000003.2085856183.00000000008EE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: comVMware20,11696428655o
                          Source: file.exe, 00000000.00000002.3045108093.0000000005C60000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}sion Settings\imloifkgjagghnncjkhggdhalmcnfklk\CURRENTTNT)(.Ya
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696428655t
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428655s
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rootpagecomVMware20,11696428655o
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pageformVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696428655j
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
                          Source: MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
                          Source: RageMP131.exe, 0000001A.00000003.2423709938.0000000001461000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}4
                          Source: RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW>
                          Source: file.exe, 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmp, RageMP131.exe, 00000008.00000002.2994677119.0000000000E3D000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000002.2884459256.0000000000E3D000.00000040.00000001.01000000.00000006.sdmp, MSIUpdaterV131.exe, 00000021.00000002.2978192451.0000000000838000.00000040.00000001.01000000.0000000B.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                          Source: MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
                          Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                          Anti Debugging

                          barindex
                          Hides threads from debuggers
                          Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebuggerJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebugger
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebugger
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebugger
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeThread information set: HideFromDebugger
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeThread information set: HideFromDebugger
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeThread information set: HideFromDebugger
                          Potentially malicious time measurement code found
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_04DF02FF Start: 04DF039F End: 04DF03250_2_04DF02FF
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_04B10A3E Start: 04B10B29 End: 04B10A5A8_2_04B10A3E
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_04BD0E60 Start: 04BD0EC9 End: 04BD0E748_2_04BD0E60
                          Tries to detect sandboxes and other dynamic analysis tools (window names)
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: regmonclass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: gbdyllo
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: procmon_window_class
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: ollydbg
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: filemonclass
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeFile opened: NTICE
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeFile opened: SICE
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeFile opened: SIWVID
                          Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                          Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeProcess queried: DebugPort
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_04D00CD4 rdtsc 0_2_04D00CD4
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_00FA4B00 mov eax, dword ptr fs:[00000030h]0_2_00FA4B00
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeCode function: 8_2_00B94B00 mov eax, dword ptr fs:[00000030h]8_2_00B94B00
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe" Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe "C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe" Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Users\user\Desktop\file.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv oDBIuu78qUSLDogbPZYF5w.0.2
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                          Source: C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exeProcess created: unknown unknown
                          Source: file.exe, 00000000.00000003.2426464372.0000000006328000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2953181412.0000000005C88000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2992008424.00000000064F9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                          Source: file.exe, file.exe, 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: \Program Manager
                          Source: C:\Users\user\Desktop\file.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                          Source: C:\Users\user\Desktop\file.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                          Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\ VolumeInformationJump to behavior
                          Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\ VolumeInformationJump to behavior
                          Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\ VolumeInformationJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0106CE0B GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,0_2_0106CE0B
                          Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                          Stealing of Sensitive Information

                          barindex
                          Yara detected Amadeys stealer DLL
                          Source: Yara matchFile source: 44.2._z8_twA5gL3uyAKSYBl4.exe.ca0000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 42.2.MSIUpdaterV131.exe.650000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 33.2.MSIUpdaterV131.exe.650000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 00000021.00000002.2976732828.0000000000651000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000021.00000003.2482885181.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002A.00000002.2883089894.0000000000651000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002A.00000003.2481062424.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002C.00000002.2976908105.0000000000CA1000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002C.00000003.2396808803.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Yara detected RisePro Stealer
                          Source: Yara matchFile source: 00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000008.00000002.2980143223.00000000005A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\h8ozYGRfpZBL_1uFxRWmLJY.zip, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\7VjcYwCMF_u_3bGwi0Uji59.zip, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\NsDq1AXD5Zu7PIsqGltDvI0.zip, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Ci0SBvvC_ABy4cFBW3g7apa.zip, type: DROPPED
                          Found many strings related to Crypto-Wallets (likely being stolen)
                          Source: MPGPH131.exe, 00000007.00000003.2698422754.000000000099F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets
                          Source: file.exe, 00000000.00000003.2108276656.000000000097E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Jaxx Liberty Extension
                          Source: MPGPH131.exe, 00000007.00000003.2698422754.000000000099F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \AppData\Roaming\Exodus\exodus.wallet
                          Source: MPGPH131.exe, 00000007.00000003.2698422754.000000000099F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \AppData\Roaming\Exodus\exodus.wallet
                          Source: RageMP131.exe, 00000008.00000002.3051142522.0000000005AD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: t\user\AppData\Roaming\Binance\app-store.json
                          Tries to harvest and steal browser information (history, passwords, etc)
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\cookies.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.json
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
                          Tries to steal Mail credentials (via file / registry access)
                          Source: C:\Users\user\Desktop\file.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\Users\user\Desktop\file.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\Users\user\Desktop\file.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\Users\user\Desktop\file.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\Users\user\Desktop\file.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                          Source: C:\ProgramData\MPGPH131\MPGPH131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                          Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

                          Remote Access Functionality

                          barindex
                          Yara detected RisePro Stealer
                          Source: Yara matchFile source: 00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000008.00000002.2980143223.00000000005A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\h8ozYGRfpZBL_1uFxRWmLJY.zip, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\7VjcYwCMF_u_3bGwi0Uji59.zip, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\NsDq1AXD5Zu7PIsqGltDvI0.zip, type: DROPPED
                          Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\Ci0SBvvC_ABy4cFBW3g7apa.zip, type: DROPPED

                          Mitre Att&ck Matrix

                          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                          Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                          Windows Management Instrumentation                          		1
                          DLL Side-Loading                          		1
                          DLL Side-Loading                          		1
                          Deobfuscate/Decode Files or Information                          		1
                          OS Credential Dumping                          		1
                          System Time Discovery                          		Remote Services1
                          Archive Collected Data                          		1
                          Ingress Tool Transfer                          		Exfiltration Over Other Network MediumAbuse Accessibility Features
                          CredentialsDomainsDefault Accounts2
                          Command and Scripting Interpreter                          		11
                          Scheduled Task/Job                          		1
                          Extra Window Memory Injection                          		4
                          Obfuscated Files or Information                          		LSASS Memory2
                          File and Directory Discovery                          		Remote Desktop Protocol2
                          Data from Local System                          		2
                          Encrypted Channel                          		Exfiltration Over BluetoothNetwork Denial of Service
                          Email AddressesDNS ServerDomain Accounts11
                          Scheduled Task/Job                          		121
                          Registry Run Keys / Startup Folder                          		12
                          Process Injection                          		12
                          Software Packing                          		Security Account Manager245
                          System Information Discovery                          		SMB/Windows Admin Shares1
                          Email Collection                          		SteganographyAutomated ExfiltrationData Encrypted for Impact
                          Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook11
                          Scheduled Task/Job                          		1
                          DLL Side-Loading                          		NTDS1
                          Query Registry                          		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script121
                          Registry Run Keys / Startup Folder                          		1
                          File Deletion                          		LSA Secrets751
                          Security Software Discovery                          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                          Extra Window Memory Injection                          		Cached Domain Credentials26
                          Virtualization/Sandbox Evasion                          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items11
                          Masquerading                          		DCSync3
                          Process Discovery                          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job26
                          Virtualization/Sandbox Evasion                          		Proc Filesystem1
                          Application Window Discovery                          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
                          Process Injection                          		/etc/passwd and /etc/shadow1
                          Remote System Discovery                          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                          Behavior Graph

                          Hide Legend

                          Legend:

                          • Process
                          • Signature
                          • Created File
                          • DNS/IP Info
                          • Is Dropped
                          • Is Windows Process
                          • Number of created Registry Values
                          • Number of created Files
                          • Visual Basic
                          • Delphi
                          • Java
                          • .Net C# or VB.NET
                          • C, C++ or other language
                          • Is malicious
                          • Internet
                          behaviorgraph top1 signatures2 2 Behavior Graph ID: 1395796 Sample: file.exe Startdate: 21/02/2024 Architecture: WINDOWS Score: 100 124 Multi AV Scanner detection for domain / URL 2->124 126 Antivirus detection for URL or domain 2->126 128 Multi AV Scanner detection for dropped file 2->128 130 5 other signatures 2->130 8 file.exe 2 95 2->8         started        13 RageMP131.exe 2->13         started        15 MPGPH131.exe 2->15         started        17 9 other processes 2->17 process3 dnsIp4 96 185.215.113.46 WHOLESALECONNECTIONSNL Portugal 8->96 98 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->98 100 193.233.132.62 FREE-NET-ASFREEnetEU Russian Federation 8->100 74 C:\Users\user\...\d34xW9C7tg9XChbetTr2.exe, PE32 8->74 dropped 76 C:\Users\user\...\_z8_twA5gL3uyAKSYBl4.exe, PE32 8->76 dropped 78 C:\Users\user\...\Oqz1gKr60kpGbxg1Y8oi.exe, PE32 8->78 dropped 84 15 other malicious files 8->84 dropped 142 Detected unpacking (changes PE section rights) 8->142 144 Binary is likely a compiled AutoIt script file 8->144 146 Tries to steal Mail credentials (via file / registry access) 8->146 166 4 other signatures 8->166 19 _z8_twA5gL3uyAKSYBl4.exe 8->19         started        22 1zSWTheo8gASwgtmbVnB.exe 8->22         started        24 schtasks.exe 1 8->24         started        36 3 other processes 8->36 86 13 other malicious files 13->86 dropped 148 Found many strings related to Crypto-Wallets (likely being stolen) 13->148 150 Tries to harvest and steal browser information (history, passwords, etc) 13->150 152 Tries to evade debugger and weak emulator (self modifying code) 13->152 80 C:\Users\user\...\vyOycan6EgXUKkno1qul.exe, PE32 15->80 dropped 82 C:\Users\user\...\ow5lYGAMAmmdqAMRBUVa.exe, PE32 15->82 dropped 88 11 other malicious files 15->88 dropped 154 Hides threads from debuggers 15->154 156 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->156 158 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 15->158 26 SIHClient.exe 15->26         started        90 7 other malicious files 17->90 dropped 160 Antivirus detection for dropped file 17->160 162 Multi AV Scanner detection for dropped file 17->162 164 Machine Learning detection for dropped file 17->164 29 firefox.exe 17->29         started        32 msedge.exe 17->32         started        34 firefox.exe 17->34         started        38 2 other processes 17->38 file5 signatures6 process7 dnsIp8 132 Detected unpacking (changes PE section rights) 19->132 134 Tries to detect sandboxes and other dynamic analysis tools (window names) 19->134 136 Tries to evade debugger and weak emulator (self modifying code) 19->136 140 3 other signatures 19->140 138 Binary is likely a compiled AutoIt script file 22->138 40 chrome.exe 22->40         started        43 chrome.exe 22->43         started        45 chrome.exe 22->45         started        55 10 other processes 22->55 47 conhost.exe 24->47         started        104 40.68.123.157 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 26->104 112 2 other IPs or domains 26->112 106 142.250.176.206 GOOGLEUS United States 29->106 114 13 other IPs or domains 29->114 92 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 29->92 dropped 94 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 29->94 dropped 57 3 other processes 29->57 108 13.107.21.239 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 32->108 110 13.107.213.40 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 32->110 116 29 other IPs or domains 32->116 49 conhost.exe 36->49         started        51 conhost.exe 36->51         started        53 conhost.exe 36->53         started        file9 signatures10 process11 dnsIp12 102 239.255.255.250 unknown Reserved 40->102 59 chrome.exe 40->59         started        62 chrome.exe 43->62         started        64 chrome.exe 45->64         started        66 chrome.exe 55->66         started        68 msedge.exe 55->68         started        70 msedge.exe 55->70         started        72 msedge.exe 55->72         started        process13 dnsIp14 118 13.107.42.14 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 59->118 120 144.2.9.1 LINKEDINUS Netherlands 59->120 122 34 other IPs or domains 59->122

                          Screenshots

                          Thumbnails

                          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                          windows-stand

                          Antivirus, Machine Learning and Genetic Malware Detection

                          Initial Sample

                          SourceDetectionScannerLabelLink
                          file.exe100%Joe Sandbox ML

                          Dropped Files

                          SourceDetectionScannerLabelLink
                          C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe100%AviraTR/Crypt.TPM.Gen
                          C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe100%AviraTR/Crypt.TPM.Gen
                          C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe100%Joe Sandbox ML
                          C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe100%Joe Sandbox ML
                          C:\ProgramData\MPGPH131\MPGPH131.exe100%Joe Sandbox ML
                          C:\ProgramData\MPGPH131\MPGPH131.exe54%VirustotalBrowse
                          C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe60%VirustotalBrowse
                          C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe60%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\fu[1].exe33%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ladas[1].exe53%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\niks[1].exe56%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\well[1].exe29%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\amert[1].exe60%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ladas[1].exe53%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\niks[1].exe56%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\plaza[1].exe55%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\well[1].exe29%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ladas[1].exe53%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\plaza[1].exe55%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\well[1].exe29%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe60%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[2].exe60%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[1].exe33%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[2].exe33%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\niks[1].exe56%VirustotalBrowse
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\plaza[1].exe55%VirustotalBrowse

                          Unpacked PE Files

                          ⊘No Antivirus matches

                          Domains

                          ⊘No Antivirus matches

                          URLs

                          SourceDetectionScannerLabelLink
                          https://www.youtube.com--attempting-deelevation0%URL Reputationsafe
                          http://crl.micro0%URL Reputationsafe
                          https://account.bellmedia.c0%URL Reputationsafe
                          http://r3.o.lencr.org00%URL Reputationsafe
                          http://185.215.113.46/cost/ladas.exe(;100%Avira URL Cloudmalware
                          http://185.215.113.46/cost/ladas.exesive.dll100%Avira URL Cloudmalware
                          http://185.215.113.46/cost/ladas.exeidi100%Avira URL Cloudmalware
                          http://185.215.113.46/cost/fu.exeagernt100%Avira URL Cloudmalware
                          http://185.215.113.46/cost/fu.exe100%Avira URL Cloudmalware
                          http://185.215.113.46/mine/amert.exe100%Avira URL Cloudmalware
                          http://185.215.113.46/mine/amert.exe21%VirustotalBrowse
                          http://185.215.113.46/cost/fu.exe24%VirustotalBrowse
                          https://www.bbc.co.uk/0%Avira URL Cloudsafe
                          http://127.0.0.1:0%Avira URL Cloudsafe
                          http://185.215.113.46/cost/ladas.exesive.dll14%VirustotalBrowse
                          https://www.bbc.co.uk/0%VirustotalBrowse
                          https://accounts.google.comC:0%Avira URL Cloudsafe
                          https://www.youtube.comMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:0%Avira URL Cloudsafe
                          http://185.215.113.46/cost/well.exe100%Avira URL Cloudmalware
                          https://www.youtube.comd0%Avira URL Cloudsafe
                          http://185.215.113.46/cost/ladas.exe100%Avira URL Cloudmalware
                          https://www.youtube.comC:0%Avira URL Cloudsafe
                          http://r3.i.lencr.org/0.0%Avira URL Cloudsafe
                          http://185.215.113.46/mine/plaza.exeidizS9SzeRnCJb5Z-4X100%Avira URL Cloudmalware
                          http://185.215.113.46/cost/ladas.exeb100%Avira URL Cloudmalware
                          http://r3.i.lencr.org/0.0%VirustotalBrowse
                          http://185.215.113.46/cost/ladas.exe20%VirustotalBrowse
                          http://185.215.113.46/cost/ladas.exeb16%VirustotalBrowse
                          http://185.215.113.46/cost/well.exe22%VirustotalBrowse

                          Domains and IPs

                          Contacted Domains

                          ⊘No contacted domains info

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          https://ipinfo.io:443/widget/demo/191.96.227.222TRageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://duckduckgo.com/chrome_newtabfile.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://www.avito.ru/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://duckduckgo.com/ac/?q=file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://ipinfo.io/widget/demo/191.96.227.222BRageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 00000029.00000003.2691872849.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://www.youtube.com/YouTubeMPGPH131.exe, 00000007.00000003.2614228154.0000000005C25000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2616339617.0000000005C2A000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://185.215.113.46/mine/amert.exefile.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000097B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2976955927.000000000097B000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • 21%, Virustotal, Browse
                                        • Avira URL Cloud: malware
                                        		unknown
                                        http://185.215.113.46/cost/ladas.exesive.dllfile.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmptrue
                                        • 14%, Virustotal, Browse
                                        • Avira URL Cloud: malware
                                        		unknown
                                        https://spocs.getpocket.comfirefox.exe, 00000029.00000003.2436535853.000001FB92737000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2935452112.000001FB9654D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2861010042.000001FB9654D000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://accounts.google.com/firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://185.215.113.46/cost/ladas.exe(;file.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://185.215.113.46/cost/ladas.exeidiRageMP131.exe, 00000008.00000002.2980143223.00000000004DE000.00000004.00000020.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://poczta.interia.pl/mh/?mailto=%sfirefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2firefox.exe, 00000029.00000003.2854768436.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.leboncoin.fr/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://spocs.getpocket.com/spocsfirefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://ipinfo.io/nProtMRageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.youtube.comfirefox.exe, 00000027.00000002.2303785942.00000226FD9C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2483237784.000001FB91FC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2901527515.000001FB98D76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98D76000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://shavar.services.mozilla.comfirefox.exe, 00000029.00000003.2560855040.000001FB912E2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://completion.amazon.com/search/complete?q=firefox.exe, 00000029.00000003.2353070103.000001FB8E965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352450205.000001FB8E924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2353477536.000001FB8E985000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352149654.000001FB8EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://weibo.com/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2464067429.000001FB98DFB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/w3c/csswg-drafts/issues/4650firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://e.mail.ru/cgi-bin/sentmsg?mailto=%sfirefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://www.amazon.com/exec/obidos/external-search/firefox.exe, 00000029.00000003.2703606554.000001FB984F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.msn.comfirefox.exe, 00000029.00000003.2472568638.000001FB9732E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://contile.services.mozilla.com/firefox.exe, 00000029.00000003.2475084912.000001FB965FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.youtube.com--attempting-deelevationfirefox.exe, 00000027.00000002.2303785942.00000226FD9C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://github.com/mozilla-services/screenshotsfirefox.exe, 00000029.00000003.2353070103.000001FB8E965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352450205.000001FB8E924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352149654.000001FB8EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://www.reddit.com/firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://www.amazon.ca/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9firefox.exe, 00000029.00000003.2457073466.000001FB8FCAF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2455731909.000001FB8FC82000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://185.215.113.46/cost/fu.exefile.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3046630470.0000000005D2D000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.0000000000538000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • 24%, Virustotal, Browse
                                                                                • Avira URL Cloud: malware
                                                                                		unknown
                                                                                https://addons.mozilla.org/firefox/addon/facebook-container/firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://www.ebay.de/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://185.215.113.46/cost/fu.exeagerntfile.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: malware
                                                                                    		unknown
                                                                                    https://www.amazon.com/firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://www.google.com/search?client=firefox-b-d&q=firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dllfile.exe, 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1999562541.0000000004B90000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2065812545.0000000004A20000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2066983405.0000000004BB0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2991732572.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000008.00000003.2168758239.0000000004950000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2878089392.0000000000B81000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 0000001A.00000003.2360402306.0000000005230000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2421390075.0000000005C47000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://t.me/RiseProSUPPORTRageMP131.exe, 00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.2980143223.00000000005A4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21firefox.exe, 00000029.00000003.2809831387.000001FB8AE2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2838114200.000001FB8AE2F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://win.mail.ru/cgi-bin/sentmsg?mailto=%sfirefox.exe, 00000029.00000003.2362378100.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2363088949.000001FB8E6DE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://ipinfo.io/widget/demo/191.96.227.222pRageMP131.exe, 00000008.00000002.2980143223.000000000051E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://www.ecosia.org/newtab/file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brfirefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://www.youtube.com/firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://allegro.pl/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2firefox.exe, 00000029.00000003.2699380184.000001FB986F6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.bbc.co.uk/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                • 0%, Virustotal, Browse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://addons.mozilla.org/firefox/addon/to-google-translate/firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 00000029.00000003.2691872849.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2854768436.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DAD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://127.0.0.1:firefox.exe, 00000029.00000003.2475084912.000001FB9652B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2484170838.000001FB91F0A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://bugzilla.mozilla.org/show_bug.cgi?id=1607439firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://crl.microSIHClient.exe, 00000009.00000003.2187881101.0000020574385000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000002.2900308468.0000020574380000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000009.00000003.2185652439.0000020574385000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      • URL Reputation: safe
                                                                                                                      		unknown
                                                                                                                      https://ipinfo.io/RageMP131.exe, 00000008.00000002.2980143223.00000000004DE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000147E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://t.me/RiseProSUPPORThoSRageMP131.exe, 00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://static.adsafeprotected.com/firefox-etp-pixelfirefox.exe, 00000029.00000003.2854768436.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2firefox.exe, 00000029.00000003.2691798188.000001FB98DC0000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://static.adsafeprotected.com/firefox-etp-jsfirefox.exe, 00000029.00000003.2854768436.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3002271050.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2895883925.000001FB98DBE000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://detectportal.firefox.com/canonical.htmlfirefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://shavar.services.mozilla.com/firefox.exe, 00000029.00000003.2560855040.000001FB912E4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBLfirefox.exe, 00000029.00000003.2466799961.000001FB98697000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://img-getpocket.cdn.mozilla.net/Xfirefox.exe, 00000029.00000003.2475084912.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2861010042.000001FB965CD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2930019942.000001FB965CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://accounts.google.comC:firefox.exe, 00000026.00000002.2336728837.000002C2A6C50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        https://ipinfo.io:443/widget/demo/191.96.227.222file.exe, 00000000.00000002.2976955927.00000000008BE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://spocs.getpocket.com/firefox.exe, 00000029.00000003.2461036451.000001FB9BEF9000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://www.youtube.comMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:firefox.exe, 00000029.00000003.2301349556.000001FB805D5000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2299483431.000001FB805D5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                            		low
                                                                                                                                            https://www.google.com/firefox.exe, 00000029.00000003.2475084912.000001FB965CD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://185.215.113.46/cost/well.exeRageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              • 22%, Virustotal, Browse
                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                              		unknown
                                                                                                                                              https://www.iqiyi.com/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202firefox.exe, 00000029.00000003.2702286694.000001FB98645000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://185.215.113.46/cost/ladas.exeRageMP131.exe, 0000001A.00000002.2896368868.000000000147E000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 0000001A.00000002.2896368868.0000000001496000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  • 20%, Virustotal, Browse
                                                                                                                                                  • Avira URL Cloud: malware
                                                                                                                                                  		unknown
                                                                                                                                                  https://bugzilla.mozilla.org/show_bug.cgi?id=1584464firefox.exe, 00000029.00000003.2700062119.000001FB98684000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://mail.google.com/mail/?extsrc=mailto&url=%sfirefox.exe, 00000029.00000003.2741108156.000001FB8E577000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2734590873.000001FB8E577000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://ipinfo.io:443/widget/demo/191.96.227.222EHkN)RageMP131.exe, 0000001A.00000002.2896368868.000000000142B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/firefox.exe, 00000029.00000003.2477590188.000001FB927F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2433245091.000001FB927F3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://www.youtube.comdfirefox.exe, 00000023.00000002.2300285719.0000022AC2BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                          		unknown
                                                                                                                                                          https://www.youtube.comC:firefox.exe, 00000023.00000002.2300285719.0000022AC2BC0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                          		unknown
                                                                                                                                                          https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=file.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2404581198.0000000005C53000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://ac.duckduckgo.com/ac/firefox.exe, 00000029.00000003.2353070103.000001FB8E965000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352450205.000001FB8E924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2353477536.000001FB8E985000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352149654.000001FB8EA00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://duckduckgo.com/firefox.exe, 00000029.00000003.2477590188.000001FB92754000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2935452112.000001FB96558000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2352761725.000001FB8E944000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://mozilla.org/MPL/2.0/.firefox.exe, 00000029.00000003.2847640406.000001FB93284000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2407004515.000001FB966B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2407473308.000001FB966B1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2765495710.000001FB8EC7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2809831387.000001FB8AE2F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2449113424.000001FB98582000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2634765865.000001FB8EA58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2868107380.000001FB985F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2713037412.000001FB8EAA5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2755126218.000001FB8EB33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2732544717.000001FB985F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3012126900.000001FB986E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2735455297.000001FB8EA59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2902867703.000001FB986E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2514495452.000001FB91E08000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2737019437.000001FB8EAA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2887497625.000001FB8EAA4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2807551644.000001FB8EC7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2568960989.000001FB8EAB1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2862972274.000001FB966F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2360064713.000001FB8EC7E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://account.bellmedia.cfirefox.exe, 00000029.00000003.2472568638.000001FB9732E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://detectportal.firefox.comfirefox.exe, 00000029.00000003.3002271050.000001FB98D9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2472568638.000001FB9734E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3024799346.000001FB9734B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsfirefox.exe, 00000029.00000003.2723175944.000001FB8EBDD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2608964060.000001FB8EBDC000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://login.microsoftonline.comfirefox.exe, 00000029.00000003.2472568638.000001FB9732E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://r3.i.lencr.org/0.firefox.exe, 00000029.00000003.2512787341.000001FB91E84000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        • 0%, Virustotal, Browse
                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://www.ifeng.com/firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://185.215.113.46/mine/plaza.exeidizS9SzeRnCJb5Z-4Xfile.exe, 00000000.00000002.3048475504.0000000005D60000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://t.me/risepro_botY0file.exe, 00000000.00000002.2976955927.000000000091C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2389626209.000000000091C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.zhihu.com/firefox.exe, 00000029.00000003.2464067429.000001FB98DFB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox.exe, 00000029.00000003.2560855040.000001FB912CF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://185.215.113.46/cost/ladas.exebfile.exe, 00000000.00000002.2976955927.000000000097B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                • 16%, Virustotal, Browse
                                                                                                                                                                                • Avira URL Cloud: malware
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://accounts.google.comfirefox.exe, 00000026.00000002.2336728837.000002C2A6C50000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2862162587.000001FB964EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2938825525.000001FB964EB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchfile.exe, 00000000.00000003.2116611037.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2113465149.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2124224620.0000000005D2C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2200308328.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2181499507.0000000005D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2187770588.0000000005C56000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2120275076.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2404581198.0000000005C53000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2451025348.0000000005C51000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2128210493.0000000005C35000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2272359442.00000000005C4000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2301947459.0000000005C08000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000003.2276330895.00000000005C6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://support.mozilla.org/kb/captive-portalfirefox.exe, 00000029.00000003.2860186459.000001FB9739A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.3020159159.000001FB9739A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2859579934.000001FB98645000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2706123123.000001FB9739B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2702286694.000001FB98645000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2921343886.000001FB9739A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://json-schema.org/draft/2019-09/schemafirefox.exe, 00000029.00000003.2861010042.000001FB9656C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2475084912.000001FB9655F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2930019942.000001FB9656C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://r3.o.lencr.org0firefox.exe, 00000029.00000003.2512787341.000001FB91E84000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                                        		unknown

                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                        Public IPs

                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                        13.107.6.158
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        204.79.197.200
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        13.107.246.40
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        142.250.80.110
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.65.161
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        185.215.113.46
                                                                                                                                                                                        		unknownPortugal
                                                                                                                                                                                        		206894WHOLESALECONNECTIONSNLfalse
                                                                                                                                                                                        172.253.63.84
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.40.206
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        74.125.152.106
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        157.240.241.35
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		32934FACEBOOKUSfalse
                                                                                                                                                                                        34.117.237.239
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                        142.251.40.132
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        162.159.61.3
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                        142.250.65.238
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.80.3
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.40.174
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        13.107.213.40
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        172.217.131.134
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        157.240.241.1
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		32934FACEBOOKUSfalse
                                                                                                                                                                                        204.79.197.239
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        23.43.243.155
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		16625AKAMAI-ASUSfalse
                                                                                                                                                                                        13.225.63.40
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                                                        34.120.208.123
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.65.234
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.80.106
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.80.35
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        1.1.1.1
                                                                                                                                                                                        		unknownAustralia
                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                        142.250.72.106
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        13.107.21.239
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        142.250.80.74
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        144.2.9.1
                                                                                                                                                                                        		unknownNetherlands
                                                                                                                                                                                        		14413LINKEDINUSfalse
                                                                                                                                                                                        13.107.42.16
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        13.107.42.14
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        152.199.24.163
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                                                        142.250.65.206
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        239.255.255.250
                                                                                                                                                                                        		unknownReserved
                                                                                                                                                                                        		unknownunknownfalse
                                                                                                                                                                                        31.13.71.7
                                                                                                                                                                                        		unknownIreland
                                                                                                                                                                                        		32934FACEBOOKUSfalse
                                                                                                                                                                                        184.26.41.160
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		16625AKAMAI-ASUSfalse
                                                                                                                                                                                        142.250.72.98
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        34.160.144.191
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                        172.217.165.142
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.72.110
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.32.118
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        44.240.103.52
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                                                        142.251.163.84
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        72.21.81.240
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                                                        34.117.186.192
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                        23.96.180.189
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        152.195.19.97
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                                                        142.251.32.99
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.176.206
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.40.228
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        162.159.36.2
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                        44.227.167.82
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		16509AMAZON-02USfalse
                                                                                                                                                                                        142.250.80.86
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.80.42
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.64.78
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.40.230
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.41.14
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        34.117.188.166
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                        142.251.41.10
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.16.84
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.84.105
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        172.64.41.3
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                        74.125.3.138
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.176.196
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.65.196
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        40.68.123.157
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                        142.250.65.195
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        34.149.100.209
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                        23.58.127.112
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		577BACOMCAfalse
                                                                                                                                                                                        34.107.243.93
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        193.233.132.62
                                                                                                                                                                                        		unknownRussian Federation
                                                                                                                                                                                        		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                        142.250.80.54
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        34.107.221.82
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        152.199.5.152
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15133EDGECASTUSfalse
                                                                                                                                                                                        35.244.181.201
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.81.234
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        74.125.172.41
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.65.227
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.40.162
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.251.40.163
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        173.194.140.7
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.176.195
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.65.225
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse
                                                                                                                                                                                        142.250.31.84
                                                                                                                                                                                        		unknownUnited States
                                                                                                                                                                                        		15169GOOGLEUSfalse

                                                                                                                                                                                        Private

                                                                                                                                                                                        IP
                                                                                                                                                                                        192.168.2.5
                                                                                                                                                                                        127.0.0.1

                                                                                                                                                                                        General Information

                                                                                                                                                                                        Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                        Analysis ID:1395796
                                                                                                                                                                                        Start date and time:2024-02-21 02:38:05 +01:00
                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                        Overall analysis duration:0h 13m 34s
                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                        Report type:full
                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                        Number of analysed new started processes analysed:55
                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                        Technologies:
                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                        Sample name:file.exe
                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                        Classification:mal100.troj.spyw.evad.winEXE@211/936@0/88
                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                                        HCA Information:Failed
                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                                        Warnings

                                                                                                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                        • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                        • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                                                        • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                                                        • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                                                                                        Simulations

                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                        TimeTypeDescription
                                                                                                                                                                                        02:38:56Task SchedulerRun new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                        02:38:56Task SchedulerRun new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                        02:38:56AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                        02:39:05AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                        02:39:10API Interceptor1x Sleep call for process: SIHClient.exe modified
                                                                                                                                                                                        02:39:16Task SchedulerRun new task: MSIUpdaterV131 HR path: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                                        02:39:17AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131 C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe
                                                                                                                                                                                        02:39:20Task SchedulerRun new task: MSIUpdaterV131 LG path: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                                        02:39:23API Interceptor226x Sleep call for process: file.exe modified
                                                                                                                                                                                        02:39:28AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk
                                                                                                                                                                                        02:39:32Task SchedulerRun new task: explorgu path: C:\Users\user\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                                                                                                                                                        02:39:39API Interceptor222x Sleep call for process: RageMP131.exe modified
                                                                                                                                                                                        02:39:42AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131 C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe
                                                                                                                                                                                        02:39:47API Interceptor671985x Sleep call for process: MPGPH131.exe modified
                                                                                                                                                                                        02:40:38API Interceptor1x Sleep call for process: firefox.exe modified

                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                        IPs

                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                        13.107.6.158TO92l1miUYGet hashmaliciousUnknownBrowse
                                                                                                                                                                                          SecuriteInfo.com.Win32.TrojanX-gen.8991.31115.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                            SecuriteInfo.com.Win32.TrojanX-gen.8388.27993.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                              SecuriteInfo.com.Win32.TrojanX-gen.24838.26198.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                j5M1YkNve1.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                  file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                    SecuriteInfo.com.Trojan.GenericKDZ.105649.13827.32664.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                      SecuriteInfo.com.Trojan.GenericKDZ.105649.30549.11143.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                        SecuriteInfo.com.Trojan.GenericKDZ.105649.15764.2812.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                          SecuriteInfo.com.Trojan.GenericKDZ.105649.26510.19959.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                            204.79.197.200kr.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • /
                                                                                                                                                                                                            13.107.246.40OFFICIISWO.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              https://hello-world-floral-credit-99e3.leknotutri.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                https://805b4559c4b0eb39086f57ea7cd2565b23052cd656c8e214457cb4256a.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                  file.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                    https://m33h876fkad.larksuite.com/wiki/MhqXwPA1ciHmvfk380uuwXn6s8c?from=from_copylinkGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                      https://fromsmash.com/sfQaHEZ2sE-btGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                        https://ncv.microsoft.com/ARBpjoGswCGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                          https://app.archbee.com/doc/bjiMt0tkV8GsQKr5jRHuN/kx-1lPI0O6BiIwENxl_SOGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                            https://office-site1.web.app/outlook.office365.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              FW_.msgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                185.215.113.46SecuriteInfo.com.Win32.TrojanX-gen.26275.30792.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.26263.12275.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/fu.exe
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.20833.6180.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                                                                                fB3vD2jWQm.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/niks.exe
                                                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                                                                                5ws86kuyyj.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/well.exe
                                                                                                                                                                                                                                SecuriteInfo.com.Trojan.Siggen26.6766.4021.25295.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/well.exe
                                                                                                                                                                                                                                SecuriteInfo.com.Trojan.Siggen26.6766.21437.6924.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/well.exe
                                                                                                                                                                                                                                file.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/well.exe
                                                                                                                                                                                                                                1cfxwHmB63.exeGet hashmaliciousAmadey, LummaC Stealer, RedLine, RisePro Stealer, XmrigBrowse
                                                                                                                                                                                                                                • 185.215.113.46/cost/fu.exe

                                                                                                                                                                                                                                Domains

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                ASNs

                                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                GOOGLE-AS-APGoogleAsiaPacificPteLtdSGhttps://ir.shareaholic.com/e?a=1&u=https://imt.foundation/rgrandQ3El-Qsrg-ll8Kv-d58Kvo-y5%3Futm_campaign%3Dshareaholic%26utm_medium%3Dtwitter%26utm_source%3Dsocialnetwork&r=1Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 34.117.33.233
                                                                                                                                                                                                                                https://cpa-ftk.pages.dev/robots.txtGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 34.117.239.71
                                                                                                                                                                                                                                https://m33h876fkad.larksuite.com/wiki/MhqXwPA1ciHmvfk380uuwXn6s8c?from=from_copylinkGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 34.117.97.41
                                                                                                                                                                                                                                file.exeGet hashmaliciousClipboard Hijacker, RisePro StealerBrowse
                                                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                                                BinMS.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 34.117.188.166
                                                                                                                                                                                                                                file.exeGet hashmaliciousPrivateLoader, RisePro StealerBrowse
                                                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                                                https://view.storydoc.com/bwCfpdRoGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 34.117.110.147
                                                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                                                file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                                                file.exeGet hashmaliciousClipboard Hijacker, RisePro StealerBrowse
                                                                                                                                                                                                                                • 34.117.186.192
                                                                                                                                                                                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSOFFICIISWO.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 13.107.246.40
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//fwdptwl%E3%80%82com/#SPSRwA5J3Bh8iBqWlcnM??kypxg44fhlrkaixdobr=Z29vZ2xlLmNvbQ==/..=%5BUNIQID%5D&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                https://cpa-ftk.pages.dev/robots.txtGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 40.76.134.238
                                                                                                                                                                                                                                https://hello-world-floral-credit-99e3.leknotutri.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.246.40
                                                                                                                                                                                                                                https://805b4559c4b0eb39086f57ea7cd2565b23052cd656c8e214457cb4256a.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                MCYq2AqNU0.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                                                                                                                                                                                                                • 52.101.73.15
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//physicstutor%E3%80%82co.za/cgi/6WIE/jeremy@gundersencu.org/jeremy@gundersencu.org&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//physicstutor%E3%80%82co.za/cgi/6WIE/jeremy@gundersencu.org/jeremy@gundersencu.org&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                file.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                https://m33h876fkad.larksuite.com/wiki/MhqXwPA1ciHmvfk380uuwXn6s8c?from=from_copylinkGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSOFFICIISWO.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 13.107.246.40
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//fwdptwl%E3%80%82com/#SPSRwA5J3Bh8iBqWlcnM??kypxg44fhlrkaixdobr=Z29vZ2xlLmNvbQ==/..=%5BUNIQID%5D&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                https://cpa-ftk.pages.dev/robots.txtGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 40.76.134.238
                                                                                                                                                                                                                                https://hello-world-floral-credit-99e3.leknotutri.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.246.40
                                                                                                                                                                                                                                https://805b4559c4b0eb39086f57ea7cd2565b23052cd656c8e214457cb4256a.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                MCYq2AqNU0.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                                                                                                                                                                                                                • 52.101.73.15
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//physicstutor%E3%80%82co.za/cgi/6WIE/jeremy@gundersencu.org/jeremy@gundersencu.org&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//physicstutor%E3%80%82co.za/cgi/6WIE/jeremy@gundersencu.org/jeremy@gundersencu.org&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                file.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                https://m33h876fkad.larksuite.com/wiki/MhqXwPA1ciHmvfk380uuwXn6s8c?from=from_copylinkGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                WHOLESALECONNECTIONSNLSecuriteInfo.com.Win32.TrojanX-gen.304.20057.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.8991.31115.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.PWSX-gen.18507.10357.exeGet hashmaliciousAmadey, RedLine, Remcos, RisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.32
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.8388.27993.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                SecuriteInfo.com.Trojan.Siggen21.19151.20597.8736.exeGet hashmaliciousPhorpiexBrowse
                                                                                                                                                                                                                                • 185.215.113.66
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.24838.26198.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.26275.30792.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.26263.12275.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                SecuriteInfo.com.Win32.TrojanX-gen.20833.6180.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                j5M1YkNve1.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                                • 185.215.113.46
                                                                                                                                                                                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSOFFICIISWO.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 13.107.246.40
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//fwdptwl%E3%80%82com/#SPSRwA5J3Bh8iBqWlcnM??kypxg44fhlrkaixdobr=Z29vZ2xlLmNvbQ==/..=%5BUNIQID%5D&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                https://cpa-ftk.pages.dev/robots.txtGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 40.76.134.238
                                                                                                                                                                                                                                https://hello-world-floral-credit-99e3.leknotutri.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.246.40
                                                                                                                                                                                                                                https://805b4559c4b0eb39086f57ea7cd2565b23052cd656c8e214457cb4256a.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                MCYq2AqNU0.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                                                                                                                                                                                                                • 52.101.73.15
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//physicstutor%E3%80%82co.za/cgi/6WIE/jeremy@gundersencu.org/jeremy@gundersencu.org&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//physicstutor%E3%80%82co.za/cgi/6WIE/jeremy@gundersencu.org/jeremy@gundersencu.org&u=276b8dda4ef94158348d5b6b8&id=6b7205781dGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                                                                • 23.99.128.52
                                                                                                                                                                                                                                file.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40
                                                                                                                                                                                                                                https://m33h876fkad.larksuite.com/wiki/MhqXwPA1ciHmvfk380uuwXn6s8c?from=from_copylinkGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                • 13.107.213.40

                                                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                                Created / dropped Files

                                                                                                                                                                                                                                C:\ProgramData\MPGPH131\MPGPH131.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2332672
                                                                                                                                                                                                                                Entropy (8bit):7.9618356942587125
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:eHex9yDOkBt8Oi0WWY6KtnHvjQ2SUueEMpZ0Q7zax8UFQdhoOIEgXlLv:egbkB18jQ2fueEA0Q7zait3IEmv
                                                                                                                                                                                                                                MD5:9565A774CCE1318D00AAD201D54179AD
                                                                                                                                                                                                                                SHA1:9369239B7C872D3CC46E55178EEDA3CC6652E2E3
                                                                                                                                                                                                                                SHA-256:9911129661BCE9C536C1232B12B2AA19501D9DFAE099C146D25308C7BB6839AC
                                                                                                                                                                                                                                SHA-512:4EBE7B64B0EE4EBDD1EF355D3B0B5F4CFF22C83AC47E1FE317634CE3D8BA99494C5FA2790D541797C3DC52F4A71230361DC80BC2DFB4675F7F1196D89F1B0E3A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 54%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L...N@.e...............".....L........Y...........@...........................Z.....U]$...@.................................T...h....p..h1.......................................................................................................... . .`..........................@....rsrc...h1...p......................@....idata ............................@... ..+.........................@...nlyzwaah.`...p?..V..................@...lkbejoib......Y......r#.............@....taggant.0....Y.."...v#.............@...........................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):26
                                                                                                                                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                                                C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 60%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_3d60c72b-b348-42fe-88bd-76fb62640eb2.json (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7395
                                                                                                                                                                                                                                Entropy (8bit):5.162151244347729
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:QKMiICIsI3cbhbVbTbfbRbObtbyEl7nKJA6wnSrDtTZd/Sc:QPhB73cNhnzFSJ5jnSrDhZd/t
                                                                                                                                                                                                                                MD5:1E611F7EB57BEAED740F828777110F51
                                                                                                                                                                                                                                SHA1:5DD0553BD3D82EFE4DF0438BBE637221176A561A
                                                                                                                                                                                                                                SHA-256:AE3B3FB9727C4F2F0954049270998F9DC689BC72C8DE6DDBA6D920738860574E
                                                                                                                                                                                                                                SHA-512:95B471F85F84B6D7DF028F95D8ACFA9BE6941CE6F89DA0C8BA7F87D99ACC58C72BB0F91F54CF7DF00774F9F80B7DEF061A318001E835FAFCCAB969ACF40401A1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"type":"uninstall","id":"3d60c72b-b348-42fe-88bd-76fb62640eb2","creationDate":"2024-02-21T02:47:34.674Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                                                C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_3d60c72b-b348-42fe-88bd-76fb62640eb2.json.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7395
                                                                                                                                                                                                                                Entropy (8bit):5.162151244347729
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:QKMiICIsI3cbhbVbTbfbRbObtbyEl7nKJA6wnSrDtTZd/Sc:QPhB73cNhnzFSJ5jnSrDhZd/t
                                                                                                                                                                                                                                MD5:1E611F7EB57BEAED740F828777110F51
                                                                                                                                                                                                                                SHA1:5DD0553BD3D82EFE4DF0438BBE637221176A561A
                                                                                                                                                                                                                                SHA-256:AE3B3FB9727C4F2F0954049270998F9DC689BC72C8DE6DDBA6D920738860574E
                                                                                                                                                                                                                                SHA-512:95B471F85F84B6D7DF028F95D8ACFA9BE6941CE6F89DA0C8BA7F87D99ACC58C72BB0F91F54CF7DF00774F9F80B7DEF061A318001E835FAFCCAB969ACF40401A1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"type":"uninstall","id":"3d60c72b-b348-42fe-88bd-76fb62640eb2","creationDate":"2024-02-21T02:47:34.674Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                                                                                File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 4770 bytes, 1 file, at 0x2c +A "disallowedcert.stl", number 1, 1 datablock, 0x1 compression
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4770
                                                                                                                                                                                                                                Entropy (8bit):7.946747821604857
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:9/nBu64pydcvOHRUfu0xK1bQYMRSRNoYmxYvk56sHMZhh4m:9/nBuP2cGxUfu6K1bpWJ6vfh4m
                                                                                                                                                                                                                                MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
                                                                                                                                                                                                                                SHA1:719C37C320F518AC168C86723724891950911CEA
                                                                                                                                                                                                                                SHA-256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
                                                                                                                                                                                                                                SHA-512:02F88DA4B610678C31664609BCFA9D61DB8D0B0617649981AF948F670F41A6207B4EC19FECCE7385A24E0C609CBBF3F2B79A8ACAF09A03C2C432CC4DCE75E9DB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MSCF............,...................O.................2Wqh .disallowedcert.stl....^K...CK.wTS...:.w.K'.C0T.....Bh.{....C.).*.....Y@...(..).R."E..D^6........u....|f~3...o.3. ..SPK.k.o#...."{-.U..P........:..aPr.@.d......Dy.h.....)..:...!./\A.....A<I_<$...q.h..........'.....7....H...@`T..K.S.%...Y4..R.....`.....-....D...(..b..-c."...G.=.dx..S+..2.a.E....d.L...77J...c.[..@..iT&..^78..g....NW6.Ek..FY.F........cNt.O.*..R....*......D...... k........J.y...z.d...;.9_t...].@....yw..}.x....d.t..`f\K..;|.*h.X...4/.;.xT......q>.0...<...3...X..L$.&.,b.....\V....\......G..O..@..H3.....t..J..).x.?.{[..G>.7...<...^Q..z..Gw9P..d....i].n%K}.*z..2.Py...A..s...z..@...4..........4.....*Y.d..._Z.5.s..fl.C..#.K{9^.E...k..z.Ma..G.(.....5g. ...}.t.#4....$;.,....S@fs....k......u .^2.#_...I........;.......w..P...UCY...$;.S._|.x..dK...[i..q..^.l..A.?.....'N.. .L.l......m.*.+f#]............A.;.....Z..rIt....RW....Kr1e=8.=.z:Oi.z.d..r..C_......o...]j.N;.s....3@3.dgrv.

                                                                                                                                                                                                                                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):338
                                                                                                                                                                                                                                Entropy (8bit):3.1487200872765357
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:kkFklVJkfllXlE/0htlX16pFRltB+SliQlP8F+RlTRe86A+iRlERMta9b3+AL0Wy:kK8N+SkQlPlEGYRMY9z+s3Ql2DUevat
                                                                                                                                                                                                                                MD5:A1D84E8113549899509C33D57F419E11
                                                                                                                                                                                                                                SHA1:223740513B5EF4A970FF61A6D0298AF3A3A8636C
                                                                                                                                                                                                                                SHA-256:161C4C8DC9DA9821134B26BD74376311376F03DF3EB4E171D34FEA70B13D663D
                                                                                                                                                                                                                                SHA-512:36A34A7AEB1F8BE77263E6C3FD5A868BD43E4A8CCE3200211DA398424AD329892669618DC506763444C2310E065B7CB53E881ED33AC6045F132915C592E32BCF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:p...... ........9...fd..(....................................................... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 60%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\14099e71-eb43-4451-92c5-826a147d8ec8.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                                                Entropy (8bit):5.796986829626578
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:j8Ni7nKzQ1Ux/M/9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:j92PZKhDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:37D02BA38B34B7D7AFDB35EA359F458C
                                                                                                                                                                                                                                SHA1:616D965685E42E2AE9A462E4ED7038AF2B9945A1
                                                                                                                                                                                                                                SHA-256:A839D5F640888FF27D5186212B828B705FAC99F2B7D6A3C5917BBCFC233D82F4
                                                                                                                                                                                                                                SHA-512:0CA30AA4BE502555893D509C32DE38F598FF94C136BB290D425917F33F68437B4D7343304C995B67D82420DB102F6CB86696350B78E30BB753E1C0AFC5E4E249
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\24467836-8913-44df-bf91-9bc6bf79b0a8.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19910
                                                                                                                                                                                                                                Entropy (8bit):5.79610701816154
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:W78Ni7nKzQ1UA/Mn9hamJfk6vP6Oq3IkwmdK899F6GRQ9CbMoqRuX8B1sYQu:c92PiyhDO6vP6Oq3IkxRTF6GSCAos
                                                                                                                                                                                                                                MD5:A24E3B3B6FA21BABC2F65F75D5DD0140
                                                                                                                                                                                                                                SHA1:76C7C34BF37AFFE7DF6FBBC8AEF430759ABEBB42
                                                                                                                                                                                                                                SHA-256:076E63361BE014C26225C3100651634573461AA2EBF1125D4592016517F53B07
                                                                                                                                                                                                                                SHA-512:150E12BD5EFAF74873AFCE38897CD6A14D673827B2CCE4B489C23D2C087E3D14CE5061F2B07A14919B0C389AC933E4CD5A8F619773F4592EA2F82664931C73B6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"01B3FBF4C85FEC53B75C6EC99EA8828137261259721C4770847EA19FB060264D\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"consumer_mode":{"ie_usage_checked":"13352953228941632","ie_usage_times":[]},"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_sta

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\246721a6-5301-4a8a-b4f8-81c0d1d32cd9.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19910
                                                                                                                                                                                                                                Entropy (8bit):5.796146289970086
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:W78Ni7nKzQ1UA/Mn9hamJfk6vP6Oq3IkwmdK899F6GRQ9CbMoqRuX8B1sYQu:c92PiChDO6vP6Oq3IkxRTF6GSCAos
                                                                                                                                                                                                                                MD5:EB03E064481A90B1504AE1F5AE52EDF6
                                                                                                                                                                                                                                SHA1:B1D355A5478694B1E1E64DB4D483AF0520BAA8EF
                                                                                                                                                                                                                                SHA-256:8BC4BA8646FA182D9BB7B0462BC31433E733D8D09F5282EA12B49C42D7E0D8BE
                                                                                                                                                                                                                                SHA-512:F2887E4E023EB1440B00CAD17DD6CCF184012644F743ED2C54F84E44D5E914F85E619FEC27BC4898CEFD5DD1521FAEC148401458A860091DF05A93AF4DB4A87B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"01B3FBF4C85FEC53B75C6EC99EA8828137261259721C4770847EA19FB060264D\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"consumer_mode":{"ie_usage_checked":"13352953228941632","ie_usage_times":[]},"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_sta

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\27dbf597-f864-496b-af55-34381c7312fa.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                                                Entropy (8bit):5.796831612916471
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:j8Ni7YJNzQ1Uf/M8q9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:j9sHPnXuhDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:EBC1A691581EB60B3A3782C2D8FD63C2
                                                                                                                                                                                                                                SHA1:CCFE2E62CB142C417D21A08752FB9BC8813940CE
                                                                                                                                                                                                                                SHA-256:FB5BF5C784979437D9B57B25564E2B75D8E441B62D977B1AF6443193AF4B728B
                                                                                                                                                                                                                                SHA-512:C1A5314E76D81244F861E272878E7DEB63D87D8D75C36498BCF4CBE68ED0FAD6FEE1D7661CC0BBE8BB344267B2365E9BCB95D3418D788CDB84EEE369A769E7F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3272427d-d161-4e0a-a22f-19914394895a.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):43746
                                                                                                                                                                                                                                Entropy (8bit):6.096052494721234
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBNwulhDO6vP6Oq3Ikxs7FbcGoup1Xl3jVzXr4CCAt:z/Ps+wsI7ynE26CIkxichu3VlXr4CRoA
                                                                                                                                                                                                                                MD5:B49ADDDF11C7596D4CCA2C75E3BE7570
                                                                                                                                                                                                                                SHA1:3E39605B390DA278E4463F0874B19789CDA585CA
                                                                                                                                                                                                                                SHA-256:CB4B56301684F9DA003F74260BC2E79A402F5304FCA05D1D632739DDF5B07BFE
                                                                                                                                                                                                                                SHA-512:30C7556C71E2EBDB626F9645FB372735666CC7BA5065700FB6012D9145FAFF3AC0DA112A9FDF9D32E226B0C8B16D9E95ECEA306F227C49C3D52E20554F799B95
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\45d450b0-2a3e-4d99-bbe9-45a80f85071b.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):43722
                                                                                                                                                                                                                                Entropy (8bit):6.0954192806873175
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBswuohDO6vP6OzI+r/4FbcGoup1Xl3jVzXr4CCAo5:z/Ps+wsI7ynEs6TICkchu3VlXr4CRo5
                                                                                                                                                                                                                                MD5:B13A22C676FE76036BD5DB3426F6809A
                                                                                                                                                                                                                                SHA1:ECA85127B61C94CC067E7E9D18DD215346A4EC57
                                                                                                                                                                                                                                SHA-256:2A6159355B6D67A38CB211524FA7319A1D7CE4492CE5C8B6650B398BAA4D511A
                                                                                                                                                                                                                                SHA-512:D7DA0BCAC5C4A17860DECA8DF56052676E6FE4C55795F01F6370F5FD943A9CC50E64D6BA2A782CF9B996C46EEC06A51C63C4B69432AF0A088FEE08E0BF81B3F9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4eb76f1b-2f20-4652-8e18-f4e0f270d4ad.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):44596
                                                                                                                                                                                                                                Entropy (8bit):6.096117663359574
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBLwuQhDO6vP6OFHcfWFQndcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEV6mjchu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:EDED1C1F6D4964E68209A574A541E57E
                                                                                                                                                                                                                                SHA1:ECB785208CD247C3706CD793688AE3B9A4E5FED8
                                                                                                                                                                                                                                SHA-256:E71069550BC2971C04BAFA7F7AA13A63DB3C48597BC2FF7949949C3F94C60ACC
                                                                                                                                                                                                                                SHA-512:1E6A721D3377B8DF90F412B7AA421AFF26C6E33B349143B34DCD88C91622E5FE6EC9B20F4B261A9651C1AC2B6AB317109282CEE14EDE359D2371D6655272AF65
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\50bf93ab-650f-4edc-94c1-673e9890b040.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                                                Entropy (8bit):5.797118382739283
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:/8Ni7nKzQ1U7/Mj9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:/92PTehDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:3C77AB367D8215AAEBEED357D90E44FA
                                                                                                                                                                                                                                SHA1:AB60F5E70831801D7464330DE53E4CEB0159F544
                                                                                                                                                                                                                                SHA-256:FB30F2D5061CAC52BE8058F59219B5BB7ACD5CEC38813C74813529549428EEE4
                                                                                                                                                                                                                                SHA-512:0EDE1F98B9EA5D813372EC6BD4F477F006B3936AC881B63AFBC9D95440CD6BC3E7CAE6EA923E847FD3B2DEAC5D18C832BF440CB75617C57F7F35773E6B2E61DA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"01B3FBF4C85FEC53B75C6EC99EA8828137261259721C4770847EA19FB060264D\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5930159c-d28c-45e5-bca8-5d7118fe1e19.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):43722
                                                                                                                                                                                                                                Entropy (8bit):6.0954192806873175
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBswuohDO6vP6OzI+r/4FbcGoup1Xl3jVzXr4CCAo5:z/Ps+wsI7ynEs6TICkchu3VlXr4CRo5
                                                                                                                                                                                                                                MD5:B13A22C676FE76036BD5DB3426F6809A
                                                                                                                                                                                                                                SHA1:ECA85127B61C94CC067E7E9D18DD215346A4EC57
                                                                                                                                                                                                                                SHA-256:2A6159355B6D67A38CB211524FA7319A1D7CE4492CE5C8B6650B398BAA4D511A
                                                                                                                                                                                                                                SHA-512:D7DA0BCAC5C4A17860DECA8DF56052676E6FE4C55795F01F6370F5FD943A9CC50E64D6BA2A782CF9B996C46EEC06A51C63C4B69432AF0A088FEE08E0BF81B3F9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\64c797ac-e863-403b-81fa-b847ba566720.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):43802
                                                                                                                                                                                                                                Entropy (8bit):6.095301057754811
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4xkBLwulhDO6vP6Oq3IkxITF6cGoup1Xl3jVzXr4CCAt:z/Ps+wsI7yOE06CIkxvchu3VlXr4CRoA
                                                                                                                                                                                                                                MD5:DA52A4B0551A1681D672FF17143FE160
                                                                                                                                                                                                                                SHA1:F1E13F2FC461CD79F723AFF585F928818BB99D98
                                                                                                                                                                                                                                SHA-256:626AA877568F815FF70091C4B97B501C67BD57E0DEFF01FD26300D1034AA24B8
                                                                                                                                                                                                                                SHA-512:370D465A8B897D89E2C1296993C0753B1F7D2A39AEB6335E0E4300E485A6C80596BC4F56F8FC94B7F51181A64A7BAB3BA3777C452E793207F12317E422EB9C4E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7f69f9db-06dc-4b7d-be03-d3bef5b6d040.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                                                Entropy (8bit):5.797099703502806
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:/8Ni7nKzQ1Ux/M/9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:/92PZKhDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:8DFEE70840786CECF8DB0F8421E12CF8
                                                                                                                                                                                                                                SHA1:82BDEAF53F8993E6AA56473FE1BB965B51E3CD42
                                                                                                                                                                                                                                SHA-256:1981C4641ACC4B632FBD5E4FA939C7E6B4A7C9C77E24043ADFE565E0232E6FBD
                                                                                                                                                                                                                                SHA-512:EED278A42DA88C074AC1792722A89A514EB32C360C8202B072982E58203790334BDBF8E7AA62787E9223BFAB58C3A2264E6F0AD4B02FC022B703B2B5D4AFBA75
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"01B3FBF4C85FEC53B75C6EC99EA8828137261259721C4770847EA19FB060264D\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8db583ff-ea7c-4f52-88a8-2a22c3564b62.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9a4de153-75cb-4105-8390-65e0c1093c48.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19910
                                                                                                                                                                                                                                Entropy (8bit):5.796099397380163
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:W78Ni7nKzQ1U7/MD9hamJfk6vP6Oq3IkwmdK899F6GRQ9CbMoqRuX8B1sYQu:c92PTOhDO6vP6Oq3IkxRTF6GSCAos
                                                                                                                                                                                                                                MD5:40033D873DBB028892951C696459EDE5
                                                                                                                                                                                                                                SHA1:A2D701F681FF53517B078783950817A3F777268C
                                                                                                                                                                                                                                SHA-256:8F1783E92A6F9805A60C8DAD699E21BD1038803BE6349869C43650B5F63B3F31
                                                                                                                                                                                                                                SHA-512:99DEC3099A05D9097CDA478FA5D6EDBF2EBCD72A1C5DC83B56C30F48AE089830706F6AA81B232258B640257C1CAB4F569038E8D1C4EE3CB025F6B279FDC52003
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"01B3FBF4C85FEC53B75C6EC99EA8828137261259721C4770847EA19FB060264D\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"consumer_mode":{"ie_usage_checked":"13352953228941632","ie_usage_times":[]},"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_sta

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65D55443-23FC.pma

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4194304
                                                                                                                                                                                                                                Entropy (8bit):0.04086072480544762
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:kA0o3tmP6razfJXCqltLuLyTfDVg8Xu1cEI6T+DhPcNIno1gQstF/iPn8y08TcmQ:70stCxaGKWdhUgAgBF6P08T2RGOD
                                                                                                                                                                                                                                MD5:E09CA9347A4CB49E6A6188923630C4F2
                                                                                                                                                                                                                                SHA1:E3BAB825F74F0A3747C4E1E90ECF0F55DB8BBEA9
                                                                                                                                                                                                                                SHA-256:8A1FE8F0C1CD1DE4C730EC9E503153C7D165D301E8DA40E61761DF84F1125494
                                                                                                                                                                                                                                SHA-512:2F86D80CA20FC1A563A82ED64DD4F7C3B139333E058E5C13BEEB62928AAD2B511083BE195AD890A3EFDDB6FC531782621FB54ECA3EEEC12277F5ACA5EAD0E4F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...@..@...@.....C.].....@...............xb..0R..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".bpbwiu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U.>.........."....."...2...".*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65D55443-628.pma

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4194304
                                                                                                                                                                                                                                Entropy (8bit):0.040853662664139534
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:kD0botmP6raZOJXCqltLuLyTfDVg8Xh1cEI6T/hcdcNIno1gQs1c/nn8y08Tcm2D:g0kthxaGKVoh3gAg5cP08T2RGOD
                                                                                                                                                                                                                                MD5:2C21F24F05F7238AA497C546100AFAC0
                                                                                                                                                                                                                                SHA1:C0DB5D2FCBB0EA63156F9C66EDF416B75FEFC8DC
                                                                                                                                                                                                                                SHA-256:AEB9265B2C89160060ECCFDD0A3DF20D37972C30E4356E0A1FF74B932372579B
                                                                                                                                                                                                                                SHA-512:9F7B0EE396A749153EDDC20B694B39D81F8371EFC33DDB398D7B3294F4556E0B1A3BFD0A768085A5F040B6ED7A5C50E5C4E8B1D503B899068569D2321681B166
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...@..@...@.....C.].....@...............xb..0R..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".bpbwiu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U.>.........."....."...2...".*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65D55445-2500.pma

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4194304
                                                                                                                                                                                                                                Entropy (8bit):0.4731876984636761
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:7AMSU7QUYPWaHbU0AHUb46aH04evwixQ:FYPtlIZe
                                                                                                                                                                                                                                MD5:6440AFB243BF4C8BFC8C3E333140B8D7
                                                                                                                                                                                                                                SHA1:8557A0172AEBF04897E1AA34C81013F0B0128BF1
                                                                                                                                                                                                                                SHA-256:F1A3162D62874A636D18E6436F83A15219D6DFF55C98E5AFFFA78CABBD573530
                                                                                                                                                                                                                                SHA-512:FB95628AA3F2CA369462905655A775E197A4CCF69AA6D3C4279938504A23D7F210CB9371FA8D63E02A0FAEBA68D6F4BA735A1ED2B633EF0B76FE45CC2864B835
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...@..@...@.....C.].....@..................0...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".bpbwiu20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K..>.........."....."...2...".*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z............<..8...#...msNurturingAssistanceHomeDependency.....triggered....(..$...

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):280
                                                                                                                                                                                                                                Entropy (8bit):4.138321711342517
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:FiWWltlApdeXKeyom56FjgFU3bKwBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeazogMKwBVsJDu2ziy5
                                                                                                                                                                                                                                MD5:F0C829BDF1471940CDD4846449DB47E6
                                                                                                                                                                                                                                SHA1:3F012EDFAB41642F3E3E9C334E0C06B3278A194E
                                                                                                                                                                                                                                SHA-256:A36F579AFB26963561130EF51C86195E591473C67CBB0A47C211BA209F38A9FF
                                                                                                                                                                                                                                SHA-512:F4C97F2CAD4C95C1F955B1FE11F5D54AC5D7C4A3E278CDCCB57AEDE40DC31A8605E9C2B00B6A4BBF0E0C7F88A59ED3038432016F898065C9FADA1B2419F88048
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:sdPC......................X..<EE..r/y..."lrIM8VvlZ11+DWjoQRN3UoTALFnNCWySfE1mL4NqR5k="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\169ab454-ff83-494f-b2b2-331133db559a.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13651
                                                                                                                                                                                                                                Entropy (8bit):5.2312413395853445
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:st+z+LAoRuQaIs1SfhnqNYzudbGqDpwBLn2ULjkEw6WQcrTI1aTYRn:sTcoRu1SfebGo1lpMaTYJ
                                                                                                                                                                                                                                MD5:F42BC53AD7BB6C76C46D08FE990FECA2
                                                                                                                                                                                                                                SHA1:B16C19CE660EDF1741CA4526C54C77668C1059EE
                                                                                                                                                                                                                                SHA-256:1846816C450C4AD744EEFBA7EE6357008E8CCF6927F02CD5D868437A80BD5107
                                                                                                                                                                                                                                SHA-512:1D0641791777B228764FBF63DE024857DB7985F5C393D38A78D65EB13965D73A97ED2CA353B62ED690D90F427694FFAD5878935A81ADCE611869970E14ED544E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b6496

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2be9badf-1ff5-4862-84aa-cb88660fdfab.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25013
                                                                                                                                                                                                                                Entropy (8bit):5.567026760859372
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:diMUsaWPScfxN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCDfrtrw0VpdBtut:diMUsaWPScfxNu1jarLrWqtq
                                                                                                                                                                                                                                MD5:14460B6C205B63603BB9D927058D5E11
                                                                                                                                                                                                                                SHA1:5229280066CFFB604F6E9D1E1E13C6E5E5DF7F0E
                                                                                                                                                                                                                                SHA-256:13CE74870CF872B4ED5F877E11BA08149EE29C537331B70975BEC6EACA7C006C
                                                                                                                                                                                                                                SHA-512:5278B764EDA6D08524D6179B76388CCDA94387294D2ADB5B0C63F47CB1CB9264C7BB91BA6AF0E768DB06BA58D0FF5A0D9FD594BD371D59FA5D25972783526EE9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352953158855283","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352953158855283","location":5,"ma

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3e983829-5d7b-44ca-98c5-db54fb7f4684.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10082
                                                                                                                                                                                                                                Entropy (8bit):5.125373559373755
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73+K8pXL+bV+FdYwwUSDH6WQmTI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+qlXL+bGd3wU8H6WQmU
                                                                                                                                                                                                                                MD5:35EEABEAE8A4604511883A74046CAF36
                                                                                                                                                                                                                                SHA1:02691A33DB86C74D2978AC26DDCB81E10BB8D2BF
                                                                                                                                                                                                                                SHA-256:A022EBDAED0CC20D25B10BD59C9E0A0CD41DDE86BA817961B3BDE11214DE5039
                                                                                                                                                                                                                                SHA-512:017CB4C6D67609FE9AECA458C31EAAA5BD0B88101FAD34F412162CB54D87DBB05EEB915F00D525CE76B71FB5774B78C451DC7272E3E249E7A873DD33C766A42F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3ea52571-6d31-4d3c-bb3f-cd19630f513f.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9971
                                                                                                                                                                                                                                Entropy (8bit):5.123515649230688
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73+K8pXL+bV+FdYwwADH6WQmTI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+qlXL+bGd3wOH6WQmTY
                                                                                                                                                                                                                                MD5:9C09405ACD24A65C5D01D2EA4F9B1E4E
                                                                                                                                                                                                                                SHA1:A2D13BFF4CBED8DB22895D62550115F798AEDE9D
                                                                                                                                                                                                                                SHA-256:3E3327F634A3417E2C903552C1042B9886DD975906C4F590D332B26361ABB670
                                                                                                                                                                                                                                SHA-512:A2F8F0713D5C2E84FB2205CF8BD15DE5BEF2B0BCD9C21B535532454E0B5EA236E7ED4CF7E12D897F050F2A0D62918D703F69792FDA12241F4D7E645F0992CB7B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4ffc042b-8567-4029-8986-9a6f75570042.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13594
                                                                                                                                                                                                                                Entropy (8bit):5.2304526654610175
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:st+z+LAJuQaIs1SfhnqNYzsSbGqDpwBLn2ULjkEw6WQcrTI1aTYRn:sTcJu1SfXbGo1lpMaTYJ
                                                                                                                                                                                                                                MD5:791AF31732AF88B7ED60550471A83950
                                                                                                                                                                                                                                SHA1:6024AA807A295F463FAE017604F8CA892A280A3B
                                                                                                                                                                                                                                SHA-256:40CC1E80B05B89EC0C9E8AEA3B0E5132FE30F909CE79BD16F958A94A63728789
                                                                                                                                                                                                                                SHA-512:EAD8B29DA9F83D0EFDFA7B9C1BB250EC282816E8BC769D371DFDA53DD24255977E141EC5AE8F04C47D4152986CFC85AA8B01145616AE2EA245B1B5473BFF9867
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b6496

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\617c93b7-e0dd-434a-ab31-cba2e5c6b8e1.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:L:L
                                                                                                                                                                                                                                MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                                                SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                                                SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                                                SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7417f3a5-2b85-4515-9fe4-b6d4f2704fd7.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):34463
                                                                                                                                                                                                                                Entropy (8bit):5.558244930582659
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:dHaUGaWPScfvN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUDfwtrwChDXDdKpdBtuW:dHaUGaWPScfvNu1jahLwWCVRitx
                                                                                                                                                                                                                                MD5:2613AD8B85F4B8DCDAFD12ADF3E330DF
                                                                                                                                                                                                                                SHA1:9A9709013A4D7B6299A6776CC58CE0A85C1DC69C
                                                                                                                                                                                                                                SHA-256:7D51835E7FB6DA3AD6BB52DF701F1E476638BBBB786046A015420EADCD521AD1
                                                                                                                                                                                                                                SHA-512:43176E565FB11FDAB008A6321C2A29C826FB92C58A603EF87268004C42D2108CA4D1836C876B36E5D66418C0739FAD9C0C76A3105576B496F6D9CC49D5F10295
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352953158855283","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352953158855283","location":5,"ma

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):481253
                                                                                                                                                                                                                                Entropy (8bit):5.396163822626188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:v+477TZyhJOGiMlbOFbXG/KFd2X13p8S15tndAYDI11csxg:v+4zZoOG1eLG/KKp8cdAYDI11csq
                                                                                                                                                                                                                                MD5:C51312169285BA1DFBE0896716114351
                                                                                                                                                                                                                                SHA1:FC4CC78FA79D98A7CC0FCAD9A162D5F6DBE616F4
                                                                                                                                                                                                                                SHA-256:6C35F97803DFD19CA2FD477A7A5CF9BDE7E8E475F51B24E2ACD7787A347813FC
                                                                                                                                                                                                                                SHA-512:B8EE80FB4105219227B7797669E41A704E13DB1EA0B3942AFED47567CF5334D2C702A5736302D539EC8253CF99AADB69C05216730A939CB99D318B18B5B0D672
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13340900604462938.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):336
                                                                                                                                                                                                                                Entropy (8bit):5.131442450984058
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bAaHOq2P923oH+Tcwt9Eh1tIFUt8KR9bAQ9Zmw+KR9bbGxPkwO923oH+TcwtY:rsv4Yeb9Eh16FUt8K3/+KUP5LYeb9Ehx
                                                                                                                                                                                                                                MD5:9251B068378BF3BC4FEECC2A12C6FBAC
                                                                                                                                                                                                                                SHA1:448B6B9D7C1F1023BE05E5E3CB8178160DD53ED1
                                                                                                                                                                                                                                SHA-256:F4D854594B8E0C88133F4CFBB0920B8003284D39CF6E2660AB81CE61306C0EA6
                                                                                                                                                                                                                                SHA-512:03D939CB77872A1EE4EB560490646CCB0B8BD7026B2ED2CB79C1E0E7FB731AB6FE869007AB937B4481B82B718A01FEC1E30951F53312FA4C6EBAD39B10DCA932
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:52.847 2db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/02/21-02:39:52.852 2db4 Recovering log #3.2024/02/21-02:39:53.078 2db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):336
                                                                                                                                                                                                                                Entropy (8bit):5.131442450984058
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bAaHOq2P923oH+Tcwt9Eh1tIFUt8KR9bAQ9Zmw+KR9bbGxPkwO923oH+TcwtY:rsv4Yeb9Eh16FUt8K3/+KUP5LYeb9Ehx
                                                                                                                                                                                                                                MD5:9251B068378BF3BC4FEECC2A12C6FBAC
                                                                                                                                                                                                                                SHA1:448B6B9D7C1F1023BE05E5E3CB8178160DD53ED1
                                                                                                                                                                                                                                SHA-256:F4D854594B8E0C88133F4CFBB0920B8003284D39CF6E2660AB81CE61306C0EA6
                                                                                                                                                                                                                                SHA-512:03D939CB77872A1EE4EB560490646CCB0B8BD7026B2ED2CB79C1E0E7FB731AB6FE869007AB937B4481B82B718A01FEC1E30951F53312FA4C6EBAD39B10DCA932
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:52.847 2db4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/02/21-02:39:52.852 2db4 Recovering log #3.2024/02/21-02:39:53.078 2db4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):28672
                                                                                                                                                                                                                                Entropy (8bit):0.4351464020915919
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwjfBI:TouQq3qh7z3bY2LNW9WMcU4B
                                                                                                                                                                                                                                MD5:7DB15A0E3CFE9C43522CF49ECE450F2E
                                                                                                                                                                                                                                SHA1:A195D4F4A064FD651AED3BB2027A157C0C413059
                                                                                                                                                                                                                                SHA-256:D0CAEB5CBE48AC7F3C7965CA578C6ED9AC827558FCB3B91409B767C23E2DED57
                                                                                                                                                                                                                                SHA-512:E062BB6D297DEEBD6C4D8D2839922C4EA0209D1DD8E933DEC4A9E4D14A326AF33B2E0C5833D47188EA02976A9C23D9B7849F8D05077E63D52AB385E015011731
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10240
                                                                                                                                                                                                                                Entropy (8bit):0.8708334089814068
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
                                                                                                                                                                                                                                MD5:92F9F7F28AB4823C874D79EDF2F582DE
                                                                                                                                                                                                                                SHA1:2D4F1B04C314C79D76B7FF3F50056ECA517C338B
                                                                                                                                                                                                                                SHA-256:6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
                                                                                                                                                                                                                                SHA-512:86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):348
                                                                                                                                                                                                                                Entropy (8bit):5.138817561155282
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bkdkq2P923oH+TcwtnG2tMsIFUt8KR9bNLzZmw+KR9bN6kwO923oH+TcwtnGg:r8kv4Yebn9GFUt8KFf/+KF65LYebn95J
                                                                                                                                                                                                                                MD5:547B4AA1E5E0668BA89FDF5F6F9F823B
                                                                                                                                                                                                                                SHA1:4AB5568B58BC883AA221C898B028FFA30B1D4800
                                                                                                                                                                                                                                SHA-256:D4BF314CD8774B25C6559A707B6A4A3B0645FE2BF1DFA294597FD5E6DAFEEA91
                                                                                                                                                                                                                                SHA-512:580FA2D0A2B21D2B666954BB6184B31322E269F21A778D7620F16D76F9225439E31D5823687326277641994802CC865EE4A6525E5D9494D6A7837589F4655E65
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:18.992 28f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/02/21-02:39:19.000 28f0 Recovering log #3.2024/02/21-02:39:19.007 28f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):348
                                                                                                                                                                                                                                Entropy (8bit):5.138817561155282
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bkdkq2P923oH+TcwtnG2tMsIFUt8KR9bNLzZmw+KR9bN6kwO923oH+TcwtnGg:r8kv4Yebn9GFUt8KFf/+KF65LYebn95J
                                                                                                                                                                                                                                MD5:547B4AA1E5E0668BA89FDF5F6F9F823B
                                                                                                                                                                                                                                SHA1:4AB5568B58BC883AA221C898B028FFA30B1D4800
                                                                                                                                                                                                                                SHA-256:D4BF314CD8774B25C6559A707B6A4A3B0645FE2BF1DFA294597FD5E6DAFEEA91
                                                                                                                                                                                                                                SHA-512:580FA2D0A2B21D2B666954BB6184B31322E269F21A778D7620F16D76F9225439E31D5823687326277641994802CC865EE4A6525E5D9494D6A7837589F4655E65
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:18.992 28f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/02/21-02:39:19.000 28f0 Recovering log #3.2024/02/21-02:39:19.007 28f0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):380
                                                                                                                                                                                                                                Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                                                                                MD5:9FE07A071FDA31327FA322B32FCA0B7E
                                                                                                                                                                                                                                SHA1:A3E0BAE8853A163C9BB55F68616C795AAAF462E8
                                                                                                                                                                                                                                SHA-256:E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
                                                                                                                                                                                                                                SHA-512:9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.128415882235026
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bNulM+q2P923oH+Tcwt8aPrqIFUt8KR9bNMmZmw+KR9bNcMMVkwO923oH+TcD:rFulM+v4YebL3FUt8KF3/+KFzMV5LYeo
                                                                                                                                                                                                                                MD5:9414A1FB65D467BA620B678912C3F1E8
                                                                                                                                                                                                                                SHA1:F0DF0262D4C7E3575843F2CF54362ECB23733B3B
                                                                                                                                                                                                                                SHA-256:5AFB670BDD7655C8F53EE9268F441869B6A878600F31B6A656595C33EF59E840
                                                                                                                                                                                                                                SHA-512:19254FB33DAC6031F918B6E900F8DF6584CE997327B6EA924285AD87DE159261AFC06B17021A11EFEF5D17DB6580502DB5BC3C3AC9355C8E0D0BD9E15282023A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:19.009 286c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/02/21-02:39:19.016 286c Recovering log #3.2024/02/21-02:39:19.022 286c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.128415882235026
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bNulM+q2P923oH+Tcwt8aPrqIFUt8KR9bNMmZmw+KR9bNcMMVkwO923oH+TcD:rFulM+v4YebL3FUt8KF3/+KFzMV5LYeo
                                                                                                                                                                                                                                MD5:9414A1FB65D467BA620B678912C3F1E8
                                                                                                                                                                                                                                SHA1:F0DF0262D4C7E3575843F2CF54362ECB23733B3B
                                                                                                                                                                                                                                SHA-256:5AFB670BDD7655C8F53EE9268F441869B6A878600F31B6A656595C33EF59E840
                                                                                                                                                                                                                                SHA-512:19254FB33DAC6031F918B6E900F8DF6584CE997327B6EA924285AD87DE159261AFC06B17021A11EFEF5D17DB6580502DB5BC3C3AC9355C8E0D0BD9E15282023A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:19.009 286c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/02/21-02:39:19.016 286c Recovering log #3.2024/02/21-02:39:19.022 286c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):380
                                                                                                                                                                                                                                Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                                                                                MD5:9FE07A071FDA31327FA322B32FCA0B7E
                                                                                                                                                                                                                                SHA1:A3E0BAE8853A163C9BB55F68616C795AAAF462E8
                                                                                                                                                                                                                                SHA-256:E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
                                                                                                                                                                                                                                SHA-512:9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                                                Entropy (8bit):5.173874504914741
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bNe/9+q2P923oH+Tcwt865IFUt8KR9bNi2WZmw+KR9bNi9VkwO923oH+TcwtD:rFe/9+v4Yeb/WFUt8KFi2W/+KFi9V5Lr
                                                                                                                                                                                                                                MD5:869535B853576DFE5CDF43E587483B8D
                                                                                                                                                                                                                                SHA1:EB69104BD76A9BA1428643D3CC40601592F4BB26
                                                                                                                                                                                                                                SHA-256:98BDFD7032FC04F5E5A78AB513B16C7B8DD6B211CE2C3F7336B952F55ADD8CE8
                                                                                                                                                                                                                                SHA-512:0299C965FB73F97E143D6B0E994443068FD42C00EF659AF0DBD7AB0AB64BBE7543C0394A2115AD22C8518779130A885FAAE282C56777C34698C0BBF533E1A929
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:19.058 285c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/02/21-02:39:19.061 285c Recovering log #3.2024/02/21-02:39:19.061 285c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                                                Entropy (8bit):5.173874504914741
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bNe/9+q2P923oH+Tcwt865IFUt8KR9bNi2WZmw+KR9bNi9VkwO923oH+TcwtD:rFe/9+v4Yeb/WFUt8KFi2W/+KFi9V5Lr
                                                                                                                                                                                                                                MD5:869535B853576DFE5CDF43E587483B8D
                                                                                                                                                                                                                                SHA1:EB69104BD76A9BA1428643D3CC40601592F4BB26
                                                                                                                                                                                                                                SHA-256:98BDFD7032FC04F5E5A78AB513B16C7B8DD6B211CE2C3F7336B952F55ADD8CE8
                                                                                                                                                                                                                                SHA-512:0299C965FB73F97E143D6B0E994443068FD42C00EF659AF0DBD7AB0AB64BBE7543C0394A2115AD22C8518779130A885FAAE282C56777C34698C0BBF533E1A929
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:19.058 285c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/02/21-02:39:19.061 285c Recovering log #3.2024/02/21-02:39:19.061 285c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1140
                                                                                                                                                                                                                                Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                                                                                                                                                                MD5:914FD8DC5F9A741C6947E1AB12A9D113
                                                                                                                                                                                                                                SHA1:6529EFE14E7B0BEA47D78B147243096408CDAAE4
                                                                                                                                                                                                                                SHA-256:8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
                                                                                                                                                                                                                                SHA-512:2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.146474235625556
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bOGM+q2P923oH+Tcwt8NIFUt8KR9bOAZmw+KR9bOjKqMVkwO923oH+Tcwt8+Q:rWGM+v4YebpFUt8KWA/+KWjlMV5LYeb2
                                                                                                                                                                                                                                MD5:84F00DE90D1B32693DFCD0B864AD811F
                                                                                                                                                                                                                                SHA1:16AB954A87604BE6E9C85D7E831317D6DED535D4
                                                                                                                                                                                                                                SHA-256:C22935E95E982291E4ACCB405DF1EFD2A8E95B6D7C8181735C3878F95C3536AB
                                                                                                                                                                                                                                SHA-512:70BCFB2BD8901EC1754B422F00D9786B45D8BA74AE8DE93F4265B9E1999B02139571FBDFA717EE141642F08088273B2E9689B41C3FC6410DB7AE6CD02622276B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.541 286c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/02/21-02:39:20.544 286c Recovering log #3.2024/02/21-02:39:20.546 286c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.146474235625556
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bOGM+q2P923oH+Tcwt8NIFUt8KR9bOAZmw+KR9bOjKqMVkwO923oH+Tcwt8+Q:rWGM+v4YebpFUt8KWA/+KWjlMV5LYeb2
                                                                                                                                                                                                                                MD5:84F00DE90D1B32693DFCD0B864AD811F
                                                                                                                                                                                                                                SHA1:16AB954A87604BE6E9C85D7E831317D6DED535D4
                                                                                                                                                                                                                                SHA-256:C22935E95E982291E4ACCB405DF1EFD2A8E95B6D7C8181735C3878F95C3536AB
                                                                                                                                                                                                                                SHA-512:70BCFB2BD8901EC1754B422F00D9786B45D8BA74AE8DE93F4265B9E1999B02139571FBDFA717EE141642F08088273B2E9689B41C3FC6410DB7AE6CD02622276B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.541 286c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/02/21-02:39:20.544 286c Recovering log #3.2024/02/21-02:39:20.546 286c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 13, cookie 0x8, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):28672
                                                                                                                                                                                                                                Entropy (8bit):3.4931505894801296
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:9NfWLxD4RsB5aeWLxl4gbBxsMPo1iTHPgswHUsHXzCo3:3uLx8M5aLLx6AxsciA4swPHXf3
                                                                                                                                                                                                                                MD5:1E0D8DE9BF85285A14B406F117CC0E47
                                                                                                                                                                                                                                SHA1:BBA2F5BCB149E7B1E1333BD4EDF68E3CB5F6DF40
                                                                                                                                                                                                                                SHA-256:E0AC492D3D31E2F2A3543034FED38DF7E322C087BF2855073925CD40FF418710
                                                                                                                                                                                                                                SHA-512:BF0AB0F76C6A51BAF7F150D32CB3D51660B9566D8D0A84DAD88A7D646BCE734693C4ABCD4AB7F990F13C9CCF7DDB253A5983D971E68F3A4D55385D588AAAF69D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):1.0201952502401035
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:lWLxYBx49ayRTBLoWDxhH+bDo3iN0Z2TVJkXBBE3ybWQWLx/BQA46d:0LxSOvRTuEhIU3iGAIBBE3qgLxZQzC
                                                                                                                                                                                                                                MD5:5FF6D8C9827633D287C532C2D8917FA0
                                                                                                                                                                                                                                SHA1:B47ECD0F7007661A02074122AC6E42925A3C5C00
                                                                                                                                                                                                                                SHA-256:761248FA309C58626241E5F43BDAB649557B2D87FDA821B796EF2040C4E34240
                                                                                                                                                                                                                                SHA-512:1EED9F22CCE594400B27085FC74C1E5929BF6036D13CCA352D4E1670F61336B5FCFF32FAE85172DB70CC7847E8DB41A442869EE39097067EA4059C099A7E83F4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):115717
                                                                                                                                                                                                                                Entropy (8bit):5.183660917461099
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                                                                                MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                                                                                SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                                                                                SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                                                                                SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):45056
                                                                                                                                                                                                                                Entropy (8bit):3.5489943165918185
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:jj9P0OBKh+ctQkQerPP/KbtZ773pLIRKToaA9gam6Ic:jdBAzte2PP/o7WRKccM
                                                                                                                                                                                                                                MD5:F1CD5C011EEEA468E59867B72385029A
                                                                                                                                                                                                                                SHA1:32062BACF572D48B8AE1B0C618116259B014E0E2
                                                                                                                                                                                                                                SHA-256:08B1DBD614E9E61207D2ABA6F995502B21243FF6CF7A73A6F8CE2173149C9E97
                                                                                                                                                                                                                                SHA-512:181DAB2ED76D60DC7F5327FC690A18C2A019AEADC6ED20F16436E3B63AF1F878AB1C53AD69A47F231459E3ED0ADA87C8C2580DC37ED30B2D8FFD78B577944C3C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):561429
                                                                                                                                                                                                                                Entropy (8bit):6.137265973662965
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:pdU61uJUvbqwZya9g7Q//NJv3Cer9um49xt8sLR/TQ+fvWK9I9kfW4Q1lFXVDF+t:GJUKzHTXJUOTr5cHTxfOP3
                                                                                                                                                                                                                                MD5:D775B6DCA5C055F179B0E333B17E675E
                                                                                                                                                                                                                                SHA1:423A1FCC91B342419DBCD9874F8E4EAC2CA3C42E
                                                                                                                                                                                                                                SHA-256:45F8DF220EFFA20C7FDECE1944196B16DE993B1C19EA1A8B2B507CE84B0E33F6
                                                                                                                                                                                                                                SHA-512:7911AD46784FCF335815FB40CD6D075F43AD405FCB9B2703DC87325AA0A7E41B657789E47816EF9D3436A513A5FD498027786B06173B0184D4A0D1E17C2E33A9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:. ......................2......."....................................xw:hv........................K.......h.t.t.p.s._.w.w.w...y.o.u.t.u.b.e...c.o.m._.0.@.1..Y.t.I.d.b.M.e.t.a....................R.g.L.............................2.......................2........................L.................................2....d.a.t.a.b.a.s.e.s......2........a.c.t.u.a.l.N.a.m.e......2..........2..........2..........2..........2..........2.............d.a.t.a.b.a.s.e.s........2.........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................d.a.t.a.b.a.s.e.s...... .................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2......

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):355
                                                                                                                                                                                                                                Entropy (8bit):5.320032762164626
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bMym81923oH+TcwtEqSAxG7RB2KLltR9b9lM+q2P923oH+TcwtEqSAxG7VIF2:rE/YebXG7RFLD1lM+v4YebXG7iFUv
                                                                                                                                                                                                                                MD5:2BBFF9FB2076780D4091C210192417AA
                                                                                                                                                                                                                                SHA1:9E4D5ACCE2F4EE7E081B6F12954F72F3646ADE6D
                                                                                                                                                                                                                                SHA-256:682EA4FBE3C26FB5A10781CDA8AAFAEDA96605A21C8E78508451066B38DDF009
                                                                                                                                                                                                                                SHA-512:F99A2A7B839FA5D071E885AEC3AC45619BBD14C6C3CEB5C524D4D25D3FFC08B8ADA3D8AB2B3DFA1D6167D2BB732FA81ECB5AEA790A1F32808E35F8C28B946A6A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:47.262 286c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb since it was missing..2024/02/21-02:39:47.344 286c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb/MANIFEST-000001.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):23
                                                                                                                                                                                                                                Entropy (8bit):4.142914673354254
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Fdb+4Ll:Zl
                                                                                                                                                                                                                                MD5:3FD11FF447C1EE23538DC4D9724427A3
                                                                                                                                                                                                                                SHA1:1335E6F71CC4E3CF7025233523B4760F8893E9C9
                                                                                                                                                                                                                                SHA-256:720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
                                                                                                                                                                                                                                SHA-512:10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:........idb_cmp1......

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):408
                                                                                                                                                                                                                                Entropy (8bit):5.27344380913003
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:rWt59+v4Yeb8rcHEZrELFUt8KW0/2W/+KW0/9V5LYeb8rcHEZrEZSJ:iC4Yeb8nZrExg8N0OV09LYeb8nZrEZe
                                                                                                                                                                                                                                MD5:BFA133670D1A9C001B1AB48BB7ACAAB4
                                                                                                                                                                                                                                SHA1:1445EF919AFB677C9D167F7487A79C51E7DABB4C
                                                                                                                                                                                                                                SHA-256:002C2809148318B2A4347420BE4F6BECE9FD6E2A773A31A4ACCBFB6F83641DA8
                                                                                                                                                                                                                                SHA-512:A88A186645F1786644239DD5D8CD09B64FAE8A7D9DC4873C7B65CB4433087CF8339854C76F66C26919971111966520007E3C1146FF2AC298909895BAFC003579
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:21.758 285c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/02/21-02:39:21.759 285c Recovering log #3.2024/02/21-02:39:21.759 285c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):408
                                                                                                                                                                                                                                Entropy (8bit):5.27344380913003
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:rWt59+v4Yeb8rcHEZrELFUt8KW0/2W/+KW0/9V5LYeb8rcHEZrEZSJ:iC4Yeb8nZrExg8N0OV09LYeb8nZrEZe
                                                                                                                                                                                                                                MD5:BFA133670D1A9C001B1AB48BB7ACAAB4
                                                                                                                                                                                                                                SHA1:1445EF919AFB677C9D167F7487A79C51E7DABB4C
                                                                                                                                                                                                                                SHA-256:002C2809148318B2A4347420BE4F6BECE9FD6E2A773A31A4ACCBFB6F83641DA8
                                                                                                                                                                                                                                SHA-512:A88A186645F1786644239DD5D8CD09B64FAE8A7D9DC4873C7B65CB4433087CF8339854C76F66C26919971111966520007E3C1146FF2AC298909895BAFC003579
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:21.758 285c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/02/21-02:39:21.759 285c Recovering log #3.2024/02/21-02:39:21.759 285c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2077
                                                                                                                                                                                                                                Entropy (8bit):5.731521059003821
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:Uw9Dl0t2QGt8P5sDNTNOIY9hnHTChyQffzWyQIaD2Cb3:Uw1lijGCP5KNTN09hnWT22Cb3
                                                                                                                                                                                                                                MD5:8E21E05921FD54CD0ED3BA5009BD7802
                                                                                                                                                                                                                                SHA1:65AC6953C638911EDC3441DE8AFB98B51D97C2FC
                                                                                                                                                                                                                                SHA-256:816B71731D85CEE30724B17A20544BFE4D1B070D5FD29502B476B4967EEBEA84
                                                                                                                                                                                                                                SHA-512:BB3AF5EECE3F7A9DBA576DC6C68FA7619A2A915A52CBD7C2E9C58F5EC0C9E2C02FF9B2C443E256E87BBDB993C3669DB40B47A4B603F4F902A1D96694A2D6294A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:....i................VERSION.1..META:https://www.youtube.com..............>_https://www.youtube.com..V955f1150||::yt-player::yt-player-lv'.{"data":"{}","creation":1708479590238}.5_https://www.youtube.com..yt-remote-connected-devicesB.{"data":"[]","expiration":1708565989355,"creation":1708479589355}.-_https://www.youtube.com..yt-remote-device-idd.{"data":"5c7177db-1690-46b1-bf04-14943d59da87","expiration":1740015589352,"creation":1708479589352}.6_https://www.youtube.com..ytidb::LAST_RESULT_ENTRY_KEYW.{"data":{"hasSucceededOnce":true},"expiration":1711071587415,"creation":1708479587415}.._https://www.youtube.com..__sakg..SX................META:https://www.youtube.com..............._https://www.youtube.com..__sakAdH.S................META:https://www.facebook.com............."_https://www.facebook.com..Session..tahbjy:1708479657470.'_https://www.facebook.com..hb_timestamp..1708479625698.<_https://www.facebook.com..mutex_falco_queue_immediately^$^$..c0m5eo:1708479623479.4_https://www.faceb

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):336
                                                                                                                                                                                                                                Entropy (8bit):5.057419684504868
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bhXbq2P923oH+Tcwt8a2jMGIFUt8KR9bXZmw+KR9b+FOPkwO923oH+Tcwt8as:rZXbv4Yeb8EFUt8K//+KWwP5LYeb8bJ
                                                                                                                                                                                                                                MD5:20DF6914F89F5319FFF8203A2F128BC4
                                                                                                                                                                                                                                SHA1:82A68E5A7CE2E52D44F440B39D9737C9AA35C70C
                                                                                                                                                                                                                                SHA-256:CC38F40B59A0DED8CAAD0EC4F5FAAB5096E1F87E6DC1296822EFB938B6ECFCBE
                                                                                                                                                                                                                                SHA-512:EFA6A07A0BEAA486DD336641B059C9E66C8822710AD155ED03C2D380AC25242F1614DA3990BE5CA594C3EC17FEA5DC9F2F94DBD9292CE7D22B5D1A1425CC83F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.093 2a24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/02/21-02:39:20.197 2a24 Recovering log #3.2024/02/21-02:39:20.225 2a24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):336
                                                                                                                                                                                                                                Entropy (8bit):5.057419684504868
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bhXbq2P923oH+Tcwt8a2jMGIFUt8KR9bXZmw+KR9b+FOPkwO923oH+Tcwt8as:rZXbv4Yeb8EFUt8K//+KWwP5LYeb8bJ
                                                                                                                                                                                                                                MD5:20DF6914F89F5319FFF8203A2F128BC4
                                                                                                                                                                                                                                SHA1:82A68E5A7CE2E52D44F440B39D9737C9AA35C70C
                                                                                                                                                                                                                                SHA-256:CC38F40B59A0DED8CAAD0EC4F5FAAB5096E1F87E6DC1296822EFB938B6ECFCBE
                                                                                                                                                                                                                                SHA-512:EFA6A07A0BEAA486DD336641B059C9E66C8822710AD155ED03C2D380AC25242F1614DA3990BE5CA594C3EC17FEA5DC9F2F94DBD9292CE7D22B5D1A1425CC83F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.093 2a24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/02/21-02:39:20.197 2a24 Recovering log #3.2024/02/21-02:39:20.225 2a24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\01575b01-2d71-4959-a3da-8c8568dd7d89.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                                                Entropy (8bit):5.44002786528171
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:YWyWNaKUXI1YDr9cyR8wXwlmUUAnIMOqySVzcO08Bv31dB8wXwlmUUAnIMp5qRBa:YWy17XI2pcO+UAnI4zcO08R7N+UAnILI
                                                                                                                                                                                                                                MD5:F758CAD8BFBFE9B31C098A271C986E38
                                                                                                                                                                                                                                SHA1:D27B76EB89DAEECB0D457B79C55BA7D7939AF7F5
                                                                                                                                                                                                                                SHA-256:E83C65D6FCB0DB78013C94A5EF17C606622154706285A4F62D349A5F178FE7CF
                                                                                                                                                                                                                                SHA-512:CA1017D2EEE4C0B903CDCE986B1843F7A602858A1798F608B193C30E041422ED4CBC82A9AAED8738497BCACC89CF62B4BC38FE5AD4DB56E82B59EBFB83279FB8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"sts":[{"expiry":1740015591.757382,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708479591.757386},{"expiry":1740015587.204084,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708479587.204088}],"version":2}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\27a21389-ef6c-47db-a39e-8d4bf2a0a9d4.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d1818c8-c09a-4480-ac66-d1f48c3ae618.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4dc84306-1ce1-4abb-b51d-bb0f8271b344.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f902616-6dc6-446e-aa07-686463d1a0fd.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):523
                                                                                                                                                                                                                                Entropy (8bit):5.484258948417003
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:YWy17XI2pcO+UAnI4zcJwrNgmh4r+UAnIL+mdR7N+UAnI0/Q:Yh17tSUWz5G1KUx7wUy/Q
                                                                                                                                                                                                                                MD5:89ECA7DBD57EB923D5B265A078A9E6AF
                                                                                                                                                                                                                                SHA1:4EFFCB826D09F632C1673AF1D6F144F41E66CCEF
                                                                                                                                                                                                                                SHA-256:2F3DB62135DB1E863E552D2ECE53A9BE3A014756E4FCF97AD446B2B85B48D924
                                                                                                                                                                                                                                SHA-512:05957D8FF2419E4B414678FE6A09F870350A2E4FADF64E48CA69F9A8B217D93EFB401143E28D586D8A9E48B8F37DFAF7FCBE1C65736517472349CB048C2FC506
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"sts":[{"expiry":1740015591.757382,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708479591.757386},{"expiry":1740015600.28787,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708479600.287873},{"expiry":1740015600.102181,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708479600.102185}],"version":2}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1419
                                                                                                                                                                                                                                Entropy (8bit):5.336394944460292
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
                                                                                                                                                                                                                                MD5:BF6BA1797785A5763A0088569A24FE85
                                                                                                                                                                                                                                SHA1:62B9D7386B7BDD97B816063ED0D9CC0D912EB130
                                                                                                                                                                                                                                SHA-256:40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
                                                                                                                                                                                                                                SHA-512:FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):36864
                                                                                                                                                                                                                                Entropy (8bit):2.7313203808978197
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:OIEumQv8m1ccnvS6Ckb2nhzXL2RWm2fPZZy2eAhftQs:npX32RXL2EXZA2euftt
                                                                                                                                                                                                                                MD5:21E218EDC9FDAC8F952D4D738A516D6B
                                                                                                                                                                                                                                SHA1:35FA1A6312CF94299D549493E3F2BC2718167578
                                                                                                                                                                                                                                SHA-256:7C9F8784E4767B223AEC1EC9BAEB12FBFAEF2EC888CC013F81D5F3F118EAF58E
                                                                                                                                                                                                                                SHA-512:CF20CA2AC4EC2FBB36047EF7109C6C3448B5073EE3699B49B74659E872A9420106423FF57E66E0C1803DB769C09FB98D0C554D7D2ED7DA4432EFF3099ECA89B8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4122c.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):356
                                                                                                                                                                                                                                Entropy (8bit):5.44002786528171
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:YWyWNaKUXI1YDr9cyR8wXwlmUUAnIMOqySVzcO08Bv31dB8wXwlmUUAnIMp5qRBa:YWy17XI2pcO+UAnI4zcO08R7N+UAnILI
                                                                                                                                                                                                                                MD5:F758CAD8BFBFE9B31C098A271C986E38
                                                                                                                                                                                                                                SHA1:D27B76EB89DAEECB0D457B79C55BA7D7939AF7F5
                                                                                                                                                                                                                                SHA-256:E83C65D6FCB0DB78013C94A5EF17C606622154706285A4F62D349A5F178FE7CF
                                                                                                                                                                                                                                SHA-512:CA1017D2EEE4C0B903CDCE986B1843F7A602858A1798F608B193C30E041422ED4CBC82A9AAED8738497BCACC89CF62B4BC38FE5AD4DB56E82B59EBFB83279FB8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"sts":[{"expiry":1740015591.757382,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1708479591.757386},{"expiry":1740015587.204084,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1708479587.204088}],"version":2}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa84932b-5ab9-42a6-9eeb-87ccc33db9ec.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1419
                                                                                                                                                                                                                                Entropy (8bit):5.336394944460292
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
                                                                                                                                                                                                                                MD5:BF6BA1797785A5763A0088569A24FE85
                                                                                                                                                                                                                                SHA1:62B9D7386B7BDD97B816063ED0D9CC0D912EB130
                                                                                                                                                                                                                                SHA-256:40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
                                                                                                                                                                                                                                SHA-512:FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9409
                                                                                                                                                                                                                                Entropy (8bit):5.102503517876817
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73o88bV+Fd2LQA66WQQI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+GbGdOQx6WQQI1aTYRn
                                                                                                                                                                                                                                MD5:381CE15D1F98E2816B6AD5CAD703757E
                                                                                                                                                                                                                                SHA1:33AB79E634CD7F89153F0859BB25B75119C325B1
                                                                                                                                                                                                                                SHA-256:6A04F68CBBCB1F5382911DE5E066FE943582E2C257CC26BC79628F93E083ABC1
                                                                                                                                                                                                                                SHA-512:82CA65DB314B2AF7350D9757094A61AD42854C3B53807FA04A506D098014A630205679BC2B522D9431F2C76E0F41D8DF7F8FD112BDE9C89813022E130B06F9BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3ecb3.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9409
                                                                                                                                                                                                                                Entropy (8bit):5.102503517876817
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73o88bV+Fd2LQA66WQQI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+GbGdOQx6WQQI1aTYRn
                                                                                                                                                                                                                                MD5:381CE15D1F98E2816B6AD5CAD703757E
                                                                                                                                                                                                                                SHA1:33AB79E634CD7F89153F0859BB25B75119C325B1
                                                                                                                                                                                                                                SHA-256:6A04F68CBBCB1F5382911DE5E066FE943582E2C257CC26BC79628F93E083ABC1
                                                                                                                                                                                                                                SHA-512:82CA65DB314B2AF7350D9757094A61AD42854C3B53807FA04A506D098014A630205679BC2B522D9431F2C76E0F41D8DF7F8FD112BDE9C89813022E130B06F9BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46434.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9409
                                                                                                                                                                                                                                Entropy (8bit):5.102503517876817
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73o88bV+Fd2LQA66WQQI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+GbGdOQx6WQQI1aTYRn
                                                                                                                                                                                                                                MD5:381CE15D1F98E2816B6AD5CAD703757E
                                                                                                                                                                                                                                SHA1:33AB79E634CD7F89153F0859BB25B75119C325B1
                                                                                                                                                                                                                                SHA-256:6A04F68CBBCB1F5382911DE5E066FE943582E2C257CC26BC79628F93E083ABC1
                                                                                                                                                                                                                                SHA-512:82CA65DB314B2AF7350D9757094A61AD42854C3B53807FA04A506D098014A630205679BC2B522D9431F2C76E0F41D8DF7F8FD112BDE9C89813022E130B06F9BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48e52.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9409
                                                                                                                                                                                                                                Entropy (8bit):5.102503517876817
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73o88bV+Fd2LQA66WQQI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+GbGdOQx6WQQI1aTYRn
                                                                                                                                                                                                                                MD5:381CE15D1F98E2816B6AD5CAD703757E
                                                                                                                                                                                                                                SHA1:33AB79E634CD7F89153F0859BB25B75119C325B1
                                                                                                                                                                                                                                SHA-256:6A04F68CBBCB1F5382911DE5E066FE943582E2C257CC26BC79628F93E083ABC1
                                                                                                                                                                                                                                SHA-512:82CA65DB314B2AF7350D9757094A61AD42854C3B53807FA04A506D098014A630205679BC2B522D9431F2C76E0F41D8DF7F8FD112BDE9C89813022E130B06F9BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c734.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9409
                                                                                                                                                                                                                                Entropy (8bit):5.102503517876817
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73o88bV+Fd2LQA66WQQI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+GbGdOQx6WQQI1aTYRn
                                                                                                                                                                                                                                MD5:381CE15D1F98E2816B6AD5CAD703757E
                                                                                                                                                                                                                                SHA1:33AB79E634CD7F89153F0859BB25B75119C325B1
                                                                                                                                                                                                                                SHA-256:6A04F68CBBCB1F5382911DE5E066FE943582E2C257CC26BC79628F93E083ABC1
                                                                                                                                                                                                                                SHA-512:82CA65DB314B2AF7350D9757094A61AD42854C3B53807FA04A506D098014A630205679BC2B522D9431F2C76E0F41D8DF7F8FD112BDE9C89813022E130B06F9BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4edc7.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9409
                                                                                                                                                                                                                                Entropy (8bit):5.102503517876817
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73o88bV+Fd2LQA66WQQI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+GbGdOQx6WQQI1aTYRn
                                                                                                                                                                                                                                MD5:381CE15D1F98E2816B6AD5CAD703757E
                                                                                                                                                                                                                                SHA1:33AB79E634CD7F89153F0859BB25B75119C325B1
                                                                                                                                                                                                                                SHA-256:6A04F68CBBCB1F5382911DE5E066FE943582E2C257CC26BC79628F93E083ABC1
                                                                                                                                                                                                                                SHA-512:82CA65DB314B2AF7350D9757094A61AD42854C3B53807FA04A506D098014A630205679BC2B522D9431F2C76E0F41D8DF7F8FD112BDE9C89813022E130B06F9BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25012
                                                                                                                                                                                                                                Entropy (8bit):5.567210469520057
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:diMUsaWPScfaN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCDfrtrw0opdBtuH:diMUsaWPScfaNu1jarLrWlt4
                                                                                                                                                                                                                                MD5:392DC9DB13CD15613527730027AD77C1
                                                                                                                                                                                                                                SHA1:64637ABCFB6A822AEAD4338ABF30BC4A5F2494E6
                                                                                                                                                                                                                                SHA-256:00BF989CA1B91903D690E160F57B31FE773C15DFF9767DF8735356399AA0600C
                                                                                                                                                                                                                                SHA-512:4C4056D6D64D764ED0B0C59408CCC04B1690709C2D10FB174BBABB082F2DD2B1BC9044158932D078AA5AC451A0BCA6725C89B346D7C325ABB8E1157E1C9C5E73
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352953158855283","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352953158855283","location":5,"ma

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3e408.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25012
                                                                                                                                                                                                                                Entropy (8bit):5.567210469520057
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:diMUsaWPScfaN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCDfrtrw0opdBtuH:diMUsaWPScfaNu1jarLrWlt4
                                                                                                                                                                                                                                MD5:392DC9DB13CD15613527730027AD77C1
                                                                                                                                                                                                                                SHA1:64637ABCFB6A822AEAD4338ABF30BC4A5F2494E6
                                                                                                                                                                                                                                SHA-256:00BF989CA1B91903D690E160F57B31FE773C15DFF9767DF8735356399AA0600C
                                                                                                                                                                                                                                SHA-512:4C4056D6D64D764ED0B0C59408CCC04B1690709C2D10FB174BBABB082F2DD2B1BC9044158932D078AA5AC451A0BCA6725C89B346D7C325ABB8E1157E1C9C5E73
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352953158855283","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352953158855283","location":5,"ma

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4c659.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25012
                                                                                                                                                                                                                                Entropy (8bit):5.567210469520057
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:diMUsaWPScfaN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCDfrtrw0opdBtuH:diMUsaWPScfaNu1jarLrWlt4
                                                                                                                                                                                                                                MD5:392DC9DB13CD15613527730027AD77C1
                                                                                                                                                                                                                                SHA1:64637ABCFB6A822AEAD4338ABF30BC4A5F2494E6
                                                                                                                                                                                                                                SHA-256:00BF989CA1B91903D690E160F57B31FE773C15DFF9767DF8735356399AA0600C
                                                                                                                                                                                                                                SHA-512:4C4056D6D64D764ED0B0C59408CCC04B1690709C2D10FB174BBABB082F2DD2B1BC9044158932D078AA5AC451A0BCA6725C89B346D7C325ABB8E1157E1C9C5E73
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352953158855283","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352953158855283","location":5,"ma

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3294
                                                                                                                                                                                                                                Entropy (8bit):6.452530824917721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:F1mKtm3VN6P6/+95KVv6DNn5EdNmmVN6P6/+95KXVNs/+95KIVNz+/+95KcVN4+R:F13J6/+7Kynisx6/+7K0/+7KL/+7Ki/Z
                                                                                                                                                                                                                                MD5:831AC3FE4E53511CD5FBF89752FE9B49
                                                                                                                                                                                                                                SHA1:71C74384DD4EB14A85C18DE2304C466D71F49697
                                                                                                                                                                                                                                SHA-256:DD181BF3B2E3895357377F7AE9D22C73028049A73024EADAD0F5A13C87C887DF
                                                                                                                                                                                                                                SHA-512:EEEEE28F203A30673AB7C4D69C617D4DEA27C466EE79B0537986E2D30EEEEA570280E8C12C055B1F8FBDD0E86960546CB0A9309A3C7A977E56C7D2C6443D93A3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2"..x2................URES:1...INITDATA_NEXT_RESOURCE_ID.2H..A.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1./INITDATA_UNIQUE_ORIGIN:https://www.youtube.com/...REG:https://www.youtube.com/.0......https://www.youtube.com/..https://www.youtube.com/sw.js .(.0.8........@...Z...... WebViewXRequestedWithDeprecation...AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9b.....trueh..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h."p.x..................................REGID_TO_ORIGIN:0.https://www.youtube.com/..RES:0.1.....vhttps://www.youtube.com/s/desktop/87423d78/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.js...."@27D9ED2AAD0901B3BCCCB194ADD5BFF90048EB

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                                                Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                                                                                MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MANIFEST-000001.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):299
                                                                                                                                                                                                                                Entropy (8bit):5.181340931644715
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bF1923oH+TcwtE/a252KLltR9bVQS39+q2P923oH+TcwtE/a2ZIFUv:rgYeb8xLD/39+v4Yeb8J2FUv
                                                                                                                                                                                                                                MD5:20B759484F45F16E0FFA2627F8811F9C
                                                                                                                                                                                                                                SHA1:2B8CBF8CD54B25C1C5B2E07787B33FEBC00BDB5F
                                                                                                                                                                                                                                SHA-256:9CD21F46BF2D888506BB280BADF583412409BE9F46BFA7722FECDCCDA239C4CC
                                                                                                                                                                                                                                SHA-512:E7A77629C4E656E547B54DD09FB30286BC1CAEF5326B5CDE59534B1B91A8B00C0BB956A9CB909FA54F7C29AFC26E939286B170493FF02D15C1B2758D56894FF1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:47.122 285c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/02/21-02:39:47.366 285c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):41
                                                                                                                                                                                                                                Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                                                                                MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):15694
                                                                                                                                                                                                                                Entropy (8bit):6.310783715488783
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:iGUcHOqEcbuCp3bkQspksx1AJdJJ2yX/vk5bSxSGtOHu+JEYW:iGNH+AILpkszyX/I8tBgW
                                                                                                                                                                                                                                MD5:038EE4DF33FD79902608824220429821
                                                                                                                                                                                                                                SHA1:0ADB43A9ADDE059CBC0CDBEF8BF8E66460E37A13
                                                                                                                                                                                                                                SHA-256:AF9CFE160A96C2B6D380BA199F2213A6B6C811EA0558004A6C6D858AB13FE360
                                                                                                                                                                                                                                SHA-512:E55F5B46DED8E8C837E44EE9C7D3EB89365E9E1F81F1DC4E458F17BC4CA7044BDB242BF0B19FA9354FCE82E29E4101AB2B4082B097A0020850F087F712AC6CC7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:0\r..m..........rSG.....0/** 6955865286672999457 */self.document = self; self.window = self;var ytcfg={d:function(){return window.yt&&yt.config_||ytcfg.data_||(ytcfg.data_={})},get:function(k,o){return k in ytcfg.d()?ytcfg.d()[k]:o},set:function(){var a=arguments;if(a.length>1)ytcfg.d()[a[0]]=a[1];else{var k;for(k in a[0])ytcfg.d()[k]=a[0][k]}}};.ytcfg.set({"EXPERIMENT_FLAGS":{"H5_enable_full_pacf_logging":true,"H5_use_async_logging":true,"ab_det_apb_b":true,"ab_det_el_h":true,"ab_det_fet_wr":true,"ab_det_fet_wr_en":true,"ab_det_gen_re":true,"action_companion_center_align_description":true,"allow_skip_networkless":true,"clear_user_partitioned_ls":true,"compress_gel":true,"csi_config_handling_infra":true,"deprecate_csi_has_info":true,"disable_child_node_auto_formatted_strings":true,"disable_pacf_logging_for_memory_limited_tv":true,"disable_simple_mixed_direction_formatted_strings":true,"disable_thumbnail_preloading":true,"embeds_transport_use_scheduler":true,"enable_ab_report_on_errorsc

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):10481
                                                                                                                                                                                                                                Entropy (8bit):5.8138143584947155
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:EzNoX/nEkf4iUMBUlozIZcRI/i7EEEId2gwix3KHk3S3SMSWcoddJi:cC/nzgiUMBkcZEEEIUgwixKHk3wX3cow
                                                                                                                                                                                                                                MD5:80B7DC2CC6A2B4496ACCF237BD5A6498
                                                                                                                                                                                                                                SHA1:2DEAA9F8CC66E872813DBCD6E400FD02115CB49A
                                                                                                                                                                                                                                SHA-256:EEA9DBD0375095052F98EBE221B1C575B14DC7A04BA0AABD89AF7206B459B00B
                                                                                                                                                                                                                                SHA-512:E446D89FF3464268F209FAF8D5B8B4106AFF5148D43C6F5554F08A449D2EED224423AE94ECDD84688086AA2C855C1945CCD0ED1F6FC19B08C36021F261D7EA85
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:0\r..m..........rSG.....0....Lp.................;M......*.(.......,T....`.....hL`0.....L`......Rcz..G....ytcfg.....Rc.>......policy...............$..a............C...C...C.,T.L.`V.....L`..........Rb&..5....yt....Rc..t.....config_.....Rc.[A....data_......Dm............!...-.....!...-.....!...-.....!...~.2........$Sb................`....Da............d..........`...P......H......,Q.(..5i....https://www.youtube.com/sw.js...a........Db............D`.......A.`............,T.L..`T.....L`..........Dm............!...-....]...r....!...-....]....../..........$Sb...............`....DaH..........c..........@......<e..........................,T...`......L`................D~X..............-......n... !...-....]...../...../..4....A./...;v............-........!...-....]...../...../..4.....,.......$Sb...............`....Da......... ..f.........D......`.... ...\...e..........................,T.$.`......L`......R....~1v...https://www.youtube.com/s/desktop/87423d78/jsbin/serviceworker-kevlar-appshell.v

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):164940
                                                                                                                                                                                                                                Entropy (8bit):5.629736689013436
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:QvX5Lw5UlDJVZHL08oy6CiEETgDAGXoY7xZSrnCvnxtsmEtn4DtATIcT3PY0Au:QvX5LKUlDJVZHL08oyRiJsD7oYb/sHnb
                                                                                                                                                                                                                                MD5:E3653A63FA8EC1F2ED9E1B38414A79A1
                                                                                                                                                                                                                                SHA1:F64D7DBEF7B5FD69A0F0824C6C08953D152CE20F
                                                                                                                                                                                                                                SHA-256:F865A64E6BB312E083ED06BA48F3256BFC211F91742C3C09BB3752500A6B47F5
                                                                                                                                                                                                                                SHA-512:6EA291A8ACF8B3B3DA1EB3442E3D0C3E8730385614F47CE9863B1F590129338782A4CCA2E917AE8EEA573426BEC6A9CF068E6AA905CFF00722D1F6C2143E373F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:0\r..m..........V.......1'use strict';var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ca=ba(this);function da(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}}.function ea(a){function b(d){return a.next(d)}.function c(d){return a.throw(d)}.return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}.f(a.next())})}.function r(a){return ea(a())}.function fa(a,b){a instanceof String&&(a+="");var c=0,d=!1,e={next:funct

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):398753
                                                                                                                                                                                                                                Entropy (8bit):6.109561109857154
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:KPiupBUlK47Bwe3XtEvK2f6DFZzQGldrjEyPnkwc:KKupBUldbXtE+FxRldrjECkV
                                                                                                                                                                                                                                MD5:AE077154ACDCEC78D710EB980613A884
                                                                                                                                                                                                                                SHA1:B846D592086C88B4C84D7338336899B91B6CA4FC
                                                                                                                                                                                                                                SHA-256:B6502BFDE039926FBC11347D8F6B6F43AD951FF21E704AF6AD903C3275A2096A
                                                                                                                                                                                                                                SHA-512:3CFE0EAF5D0112F2532BB1DFF031A88DF93BC822142480143232AA89F00C50A5D480D14935F3005350D53DFA400A3F4B669A633F63201B48458E06310F1F6E4C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:0\r..m..........V.......1....Lp.................;.......*H........,T.11..` b.....L`X......L`......Rb..q....aa...,T...`.....,L`.......}.`......Le...........................................r......(Rh...J....Cannot find global object......D.. ...........z..%...".. ...!..6........6......".. ...!..6......".. ...!..6......".. ...!..6........-...m...#../....-....!..k.........P..&..!......b..!..(Sb.............Rb.$......ba..`....Dax...n....1.Sb.`...............c.................D..Rb.`.}....$a..`.....D..Rb...B....Lf..`Z.....Rb.l,.....ti..`......Rb..O.....io..`.....D..Rb.T.....Ja..`.....D..Rb&pR.....aj..`......Rb&.......Al..`.....D..1.`R.....Rb>..H....Oj..`......RbFp......Rc..`4.....RbJ(.....Xl..`......RbB..C....Pj..`.....D..RbV02x....Ud..`F.....RbZ......Mf..`\.....RbZ.<.....Ij..`.....D..Rbf.......Gl..`......RbB.C.....tn..`.....D..Rbr..U....Mj..`.....D..Rb.x>.....Sb..`.....D..Rb..6.....Gi..`......Rb........il..`......Rb...Q....db..`......Rb..cm....Bo..`......Rb..MD....Wg..`x.....Rb.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):24
                                                                                                                                                                                                                                Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:m+l:m
                                                                                                                                                                                                                                MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:0\r..m..................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):96
                                                                                                                                                                                                                                Entropy (8bit):3.625814583693913
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:J2ojq/BlFljf/tlWcltYllBg:47JlD/GU2E
                                                                                                                                                                                                                                MD5:A5FC18BC08660F05CD4B6372BC6484F3
                                                                                                                                                                                                                                SHA1:6BBF2C6A9669EF2CC66C8A3B4344C34220DD5E94
                                                                                                                                                                                                                                SHA-256:E79BCE0A2A7C4871483472F5A67F824CF1ED638D49D50E74F70F333ECFFE9F7A
                                                                                                                                                                                                                                SHA-512:38C38A4D03F66685F82866ABE31453319DF9F881C96AE05C069821811ED6876E1279095E541167DE3359188BC700137FC765E57797E849EAF0B427B2901B718D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:X....S..oy retne........................5j.+y..L.................X....,.........g.......Ww.pp/.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):96
                                                                                                                                                                                                                                Entropy (8bit):3.625814583693913
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:J2ojq/BlFljf/tlWcltYllBg:47JlD/GU2E
                                                                                                                                                                                                                                MD5:A5FC18BC08660F05CD4B6372BC6484F3
                                                                                                                                                                                                                                SHA1:6BBF2C6A9669EF2CC66C8A3B4344C34220DD5E94
                                                                                                                                                                                                                                SHA-256:E79BCE0A2A7C4871483472F5A67F824CF1ED638D49D50E74F70F333ECFFE9F7A
                                                                                                                                                                                                                                SHA-512:38C38A4D03F66685F82866ABE31453319DF9F881C96AE05C069821811ED6876E1279095E541167DE3359188BC700137FC765E57797E849EAF0B427B2901B718D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:X....S..oy retne........................5j.+y..L.................X....,.........g.......Ww.pp/.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF46425.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):96
                                                                                                                                                                                                                                Entropy (8bit):3.625814583693913
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:J2ojq/BlFljf/tlWcltYllBg:47JlD/GU2E
                                                                                                                                                                                                                                MD5:A5FC18BC08660F05CD4B6372BC6484F3
                                                                                                                                                                                                                                SHA1:6BBF2C6A9669EF2CC66C8A3B4344C34220DD5E94
                                                                                                                                                                                                                                SHA-256:E79BCE0A2A7C4871483472F5A67F824CF1ED638D49D50E74F70F333ECFFE9F7A
                                                                                                                                                                                                                                SHA-512:38C38A4D03F66685F82866ABE31453319DF9F881C96AE05C069821811ED6876E1279095E541167DE3359188BC700137FC765E57797E849EAF0B427B2901B718D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:X....S..oy retne........................5j.+y..L.................X....,.........g.......Ww.pp/.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3623
                                                                                                                                                                                                                                Entropy (8bit):4.871464647566557
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:tZZZZT4Ntx6WhRczeRoE4i1tyccRwzdd13ua6q1iMmdlqUdfMw3zq5/RxzbllT3I:KNtxrmt6dudl5fAO
                                                                                                                                                                                                                                MD5:DA76960E06C57861CEE63F3514268872
                                                                                                                                                                                                                                SHA1:E54CF3708019C7FB34F0AA096822501AB25795CE
                                                                                                                                                                                                                                SHA-256:3EACDCC17CFBECD9ED57842605015A88F84E56BDB3DF71BE5512F3734104E6B7
                                                                                                                                                                                                                                SHA-512:96850D30BE2EE5310C644334EF061A2B79899A0A21B4EEF32594E8351A62E27DCE5009A4703C02484B6A5EFEE66BF4CDAE626FB31DF9F76C2746B6B2F66209FC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..................f................next-map-id.1.Gnamespace-f1ed2108_6ff4_4a80_b45b_612d36fcd3ab-https://www.youtube.com/.0V.e................V.e................V.e................V.e................dI.!f................next-map-id.2.Gnamespace-ce3d8b14_473e_40ca_b85f_af962f64164f-https://www.youtube.com/.1zd.>g................next-map-id.3.Hnamespace-251170a8_746e_47da_a53b_81db896bdf0c-https://www.facebook.com/.2..Ssj................next-map-id.4.Knamespace-08431575_6285_4e51_bd61_866b1ce06f49-https://accounts.google.com/.3.?..................!map-1-yt-remote-fast-check-periodb{.".d.a.t.a.".:.".1.7.0.8.4.7.9.8.8.9.3.5.5.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.8.4.7.9.5.8.9.3.5.5.}...map-1-yt-remote-session-appf{.".d.a.t.a.".:.".y.o.u.t.u.b.e.-.d.e.s.k.t.o.p.".,.".c.r.e.a.t.i.o.n.".:.1.7.0.8.4.7.9.5.8.9.3.5.5.}...map-1-yt-remote-session-nameV{.".d.a.t.a.".:.".D.e.s.k.t.o.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.007972710914067
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9btq2P923oH+TcwtrQMxIFUt8KR9bhXsZZmw+KR9bikwO923oH+TcwtrQMFLJ:rVv4YebCFUt8KZXsZ/+K65LYebtJ
                                                                                                                                                                                                                                MD5:9D8FE958CAA6E4D03B919771842783AE
                                                                                                                                                                                                                                SHA1:DFD2E7C555AAE1144831A4AC5EEB39AEF579B9C9
                                                                                                                                                                                                                                SHA-256:E9E945DB926EA71B53FB0B1C18AC6AA5C94677DFA012EDA18AF95C004C795500
                                                                                                                                                                                                                                SHA-512:ADDF6D7CF56F2CCBF59A36450ACE03F8FCC969C828B82EA783BD274E6414C195692BB09D34F6AEBFEC637D95E271415CE0DA17B4A831AC6829396DF77FEE2F72
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.077 2a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/02/21-02:39:20.093 2a00 Recovering log #3.2024/02/21-02:39:20.174 2a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.007972710914067
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9btq2P923oH+TcwtrQMxIFUt8KR9bhXsZZmw+KR9bikwO923oH+TcwtrQMFLJ:rVv4YebCFUt8KZXsZ/+K65LYebtJ
                                                                                                                                                                                                                                MD5:9D8FE958CAA6E4D03B919771842783AE
                                                                                                                                                                                                                                SHA1:DFD2E7C555AAE1144831A4AC5EEB39AEF579B9C9
                                                                                                                                                                                                                                SHA-256:E9E945DB926EA71B53FB0B1C18AC6AA5C94677DFA012EDA18AF95C004C795500
                                                                                                                                                                                                                                SHA-512:ADDF6D7CF56F2CCBF59A36450ACE03F8FCC969C828B82EA783BD274E6414C195692BB09D34F6AEBFEC637D95E271415CE0DA17B4A831AC6829396DF77FEE2F72
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.077 2a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/02/21-02:39:20.093 2a00 Recovering log #3.2024/02/21-02:39:20.174 2a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13352953161349413

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):63819
                                                                                                                                                                                                                                Entropy (8bit):3.658044036913582
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:wt9DMpPznHRMgXwhImWhJQLpmA/DHw21c1TmfRm9J02JDHLxoicLx5GaLxzgLxNa:wt9w2w0DOL0eVwVUaVUVNpUV0Vq
                                                                                                                                                                                                                                MD5:9FDEADC67DE29E08300D717AF72EE9A9
                                                                                                                                                                                                                                SHA1:0FC6E9FA64306D8CEF78EE3008EB7EC16ED55C61
                                                                                                                                                                                                                                SHA-256:127EDA588CBF066406C59A2739D7E35E27670B541BB48948EA863507CD78743A
                                                                                                                                                                                                                                SHA-512:AFB578997AB8E85E2C3EA26799E324ABA227FC71FB5BBE0F72524811BE517EF394503F5E46490AA82019D9D41BF22333C20D8EBD7B40131747E540BEDE8FDD11
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SNSS........b.'............b.'......".b.'............b.'........b.'........b.'........b.'....!...b.'................................b.'.b.'1..,....b.'$...f1ed2108_6ff4_4a80_b45b_612d36fcd3ab....b.'........b.'....%...........b.'....b.'........................b.'....................5..0....b.'&...{98952893-68FF-4A5D-A164-705C709ED3DB}......b.'...........b.'............b.'........https://www.youtube.com/....d...`...!...X....................................................................................................Yme.....Yme....................................h...............................................8.......h.t.t.p.s.:././.w.w.w...y.o.u.t.u.b.e...c.o.m./.................................8.......0.......8....................................................................... .......................................................P...$...b.a.4.3.2.b.0.8.-.d.7.6.b.-.4.1.3.b.-.b.5.c.9.-.c.4.3.9.a.e.f.a.e.b.b.8.................P...$...f.e.f.4.9.5.e.8.-.a.e.8.4.-.4.7.f.4.-.b.9.3.8.-.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.44194574462308833
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                                                                                                                                                                                                MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                                                                                                                                                                                                SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                                                                                                                                                                                                SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                                                                                                                                                                                                SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):352
                                                                                                                                                                                                                                Entropy (8bit):5.121914896509742
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9b5vMyq2P923oH+Tcwt7Uh2ghZIFUt8KR9bl1Zmw+KR9bFRkwO923oH+Tcwt7w:riyv4YebIhHh2FUt8K//+KNR5LYebIh9
                                                                                                                                                                                                                                MD5:CA15B814ABDE9B2A39E03541D65D5BF4
                                                                                                                                                                                                                                SHA1:B79B400E01F73497E2DE34B466F2618F3B913CBC
                                                                                                                                                                                                                                SHA-256:026B109232CE7291B390DF3F6906F3928C257190E551D30E0BF33B0E93248E59
                                                                                                                                                                                                                                SHA-512:A04AF04A2E026833DA26DBEE7D3BFFB5137DA7241560DDB024047CB60AEBC7ADE1F1140B26D7D751D6A61AE8C02220D08E02A6072DB2B97B93FC3151F796C6D5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:18.960 28e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/02/21-02:39:18.985 28e0 Recovering log #3.2024/02/21-02:39:18.987 28e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):352
                                                                                                                                                                                                                                Entropy (8bit):5.121914896509742
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9b5vMyq2P923oH+Tcwt7Uh2ghZIFUt8KR9bl1Zmw+KR9bFRkwO923oH+Tcwt7w:riyv4YebIhHh2FUt8K//+KNR5LYebIh9
                                                                                                                                                                                                                                MD5:CA15B814ABDE9B2A39E03541D65D5BF4
                                                                                                                                                                                                                                SHA1:B79B400E01F73497E2DE34B466F2618F3B913CBC
                                                                                                                                                                                                                                SHA-256:026B109232CE7291B390DF3F6906F3928C257190E551D30E0BF33B0E93248E59
                                                                                                                                                                                                                                SHA-512:A04AF04A2E026833DA26DBEE7D3BFFB5137DA7241560DDB024047CB60AEBC7ADE1F1140B26D7D751D6A61AE8C02220D08E02A6072DB2B97B93FC3151F796C6D5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:18.960 28e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/02/21-02:39:18.985 28e0 Recovering log #3.2024/02/21-02:39:18.987 28e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):270336
                                                                                                                                                                                                                                Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                                                MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                                                SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                                                SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                                                SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):270336
                                                                                                                                                                                                                                Entropy (8bit):0.0012471779557650352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:MsEllllkEthXllkl2zE:/M/xT02z
                                                                                                                                                                                                                                MD5:F50F89A0A91564D0B8A211F8921AA7DE
                                                                                                                                                                                                                                SHA1:112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
                                                                                                                                                                                                                                SHA-256:B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
                                                                                                                                                                                                                                SHA-512:BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):434
                                                                                                                                                                                                                                Entropy (8bit):5.159554468495133
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:riIv4YebvqBQFUt8KOZ/+K7FXo5LYebvqBvJ:m64YebvZg8GLYebvk
                                                                                                                                                                                                                                MD5:8E15EDDFB1A2EC45918AE4A96DF3C3E7
                                                                                                                                                                                                                                SHA1:C1A448443DB407D722CC7ED6911160A9C5D011E5
                                                                                                                                                                                                                                SHA-256:D280E632F0659DC5C5B9DB3930F53209EC52BF119ECF0E8F72FCA596E29045E8
                                                                                                                                                                                                                                SHA-512:33D0B104E2F7BC0AEC2136EF623FE861EC8CCB35D24DE3B94B14E66D92EC2F7B21AB754E8BB0525C27737834C969762710D4B2A315F1678821C2E9DE03AB8354
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.471 2a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/02/21-02:39:20.523 2a00 Recovering log #3.2024/02/21-02:39:20.574 2a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):434
                                                                                                                                                                                                                                Entropy (8bit):5.159554468495133
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:riIv4YebvqBQFUt8KOZ/+K7FXo5LYebvqBvJ:m64YebvZg8GLYebvk
                                                                                                                                                                                                                                MD5:8E15EDDFB1A2EC45918AE4A96DF3C3E7
                                                                                                                                                                                                                                SHA1:C1A448443DB407D722CC7ED6911160A9C5D011E5
                                                                                                                                                                                                                                SHA-256:D280E632F0659DC5C5B9DB3930F53209EC52BF119ECF0E8F72FCA596E29045E8
                                                                                                                                                                                                                                SHA-512:33D0B104E2F7BC0AEC2136EF623FE861EC8CCB35D24DE3B94B14E66D92EC2F7B21AB754E8BB0525C27737834C969762710D4B2A315F1678821C2E9DE03AB8354
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.471 2a00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/02/21-02:39:20.523 2a00 Recovering log #3.2024/02/21-02:39:20.574 2a00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5643e7a7-a6e7-414e-92b1-2d6304345c6f.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\63a94062-dc09-4014-b2a0-77f5ea6f108b.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2
                                                                                                                                                                                                                                Entropy (8bit):1.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:H:H
                                                                                                                                                                                                                                MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[]

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40
                                                                                                                                                                                                                                Entropy (8bit):4.1275671571169275
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                                                                                MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                                                                                SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                                                                                SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                                                                                SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):36864
                                                                                                                                                                                                                                Entropy (8bit):0.3886039372934488
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
                                                                                                                                                                                                                                MD5:DEA619BA33775B1BAEEC7B32110CB3BD
                                                                                                                                                                                                                                SHA1:949B8246021D004B2E772742D34B2FC8863E1AAA
                                                                                                                                                                                                                                SHA-256:3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
                                                                                                                                                                                                                                SHA-512:7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):80
                                                                                                                                                                                                                                Entropy (8bit):3.4921535629071894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                                                                                                                                                                MD5:69449520FD9C139C534E2970342C6BD8
                                                                                                                                                                                                                                SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                                                                                                                                                                SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                                                                                                                                                                SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):422
                                                                                                                                                                                                                                Entropy (8bit):5.212630809345142
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bnzIq2P923oH+TcwtzjqEKj0QMxIFUt8KR9bzZmw+KR9bWkFkwO923oH+Tcw9:rUv4YebvqBZFUt8Kr/+Kp5LYebvqBaJ
                                                                                                                                                                                                                                MD5:B996B395630AFBC221E7BF6E19DDB0A7
                                                                                                                                                                                                                                SHA1:9F0463E2D4F0FAAE47CFC5949A5D91A87C2E3DAE
                                                                                                                                                                                                                                SHA-256:75631B7B58B0EF72816AB2678F31CE147C496AF77A082F762E28444AF9A221C0
                                                                                                                                                                                                                                SHA-512:3BA247E525D0B5F0F685586B77FEDB853BA009B1EF1931D79DADC3A926A87F62AF7F3718CE214585BBBC4ABDF91E59C6EC0AF04713428CCDF2F56BAF72C10C84
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:36.806 2a24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/02/21-02:39:36.808 2a24 Recovering log #3.2024/02/21-02:39:36.853 2a24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):422
                                                                                                                                                                                                                                Entropy (8bit):5.212630809345142
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bnzIq2P923oH+TcwtzjqEKj0QMxIFUt8KR9bzZmw+KR9bWkFkwO923oH+Tcw9:rUv4YebvqBZFUt8Kr/+Kp5LYebvqBaJ
                                                                                                                                                                                                                                MD5:B996B395630AFBC221E7BF6E19DDB0A7
                                                                                                                                                                                                                                SHA1:9F0463E2D4F0FAAE47CFC5949A5D91A87C2E3DAE
                                                                                                                                                                                                                                SHA-256:75631B7B58B0EF72816AB2678F31CE147C496AF77A082F762E28444AF9A221C0
                                                                                                                                                                                                                                SHA-512:3BA247E525D0B5F0F685586B77FEDB853BA009B1EF1931D79DADC3A926A87F62AF7F3718CE214585BBBC4ABDF91E59C6EC0AF04713428CCDF2F56BAF72C10C84
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:36.806 2a24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/02/21-02:39:36.808 2a24 Recovering log #3.2024/02/21-02:39:36.853 2a24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                                                Entropy (8bit):5.156744425431894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bgtdrSQ+q2P923oH+TcwtpIFUt8KR9bJDQgZmw+KR9bfvmQVkwO923oH+Tcwd:r6drSVv4YebmFUt8KlQg/+KXuI5LYeb7
                                                                                                                                                                                                                                MD5:1674A0A446C1F97E1AE7C6F354B694E7
                                                                                                                                                                                                                                SHA1:4B2B6C820A6BF943B4BF19B294DA61F8F3CE8143
                                                                                                                                                                                                                                SHA-256:1BB13A3D04192946A55F30B3D37929EBFE8E49C6A19B5C72E1ED11FFD46B4F18
                                                                                                                                                                                                                                SHA-512:3BED213B23A3430CCFD53049ADA8DFDF603745D56D0069AED2B87BC793208C2B121E0CC7BD8091772431896C415464A8DA814BDF3A903B4E7CDE38C0C9AFF304
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:18.891 28d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/02/21-02:39:18.892 28d8 Recovering log #3.2024/02/21-02:39:18.900 28d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                                                Entropy (8bit):5.156744425431894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bgtdrSQ+q2P923oH+TcwtpIFUt8KR9bJDQgZmw+KR9bfvmQVkwO923oH+Tcwd:r6drSVv4YebmFUt8KlQg/+KXuI5LYeb7
                                                                                                                                                                                                                                MD5:1674A0A446C1F97E1AE7C6F354B694E7
                                                                                                                                                                                                                                SHA1:4B2B6C820A6BF943B4BF19B294DA61F8F3CE8143
                                                                                                                                                                                                                                SHA-256:1BB13A3D04192946A55F30B3D37929EBFE8E49C6A19B5C72E1ED11FFD46B4F18
                                                                                                                                                                                                                                SHA-512:3BED213B23A3430CCFD53049ADA8DFDF603745D56D0069AED2B87BC793208C2B121E0CC7BD8091772431896C415464A8DA814BDF3A903B4E7CDE38C0C9AFF304
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:18.891 28d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/02/21-02:39:18.892 28d8 Recovering log #3.2024/02/21-02:39:18.900 28d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):131072
                                                                                                                                                                                                                                Entropy (8bit):0.01310734823830204
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:ImtV9AARcHOg/itEwsFRtlUF8SAl1KvTvG2WfB/t4i9rBJAlt/57ll10mV/t:IiV9AAM6tsFREiliCxfpCCrsl7h
                                                                                                                                                                                                                                MD5:2BCCE3173569F0430C2509A027E4968B
                                                                                                                                                                                                                                SHA1:8BB2F291DB9A4307802D1F9DB6434C923CE34112
                                                                                                                                                                                                                                SHA-256:DD8793FCCB370AAD91AF2513E7540A3219509DBB909A1CEA3795E3AD1A0CB7FA
                                                                                                                                                                                                                                SHA-512:2D17B9C6C3AC64954002BAAD89FB5066E24D15ADC68A646968A695EDD2A96AAB0F67E30845809AED435300CEC0C29FD9BDD4F116ADF18F39E6BEC6AAE99C19A9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:VLnk.....?......?......+................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 11, database pages 92, cookie 0x36, schema 4, UTF-8, version-valid-for 11
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2789549949550818
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:p/2qOB1nxCkfSAELyKOMq+8yC8F/YfU5m+OlTLVumUy:oq+n0c9ELyKOMq+8y9/OwDy
                                                                                                                                                                                                                                MD5:7E4A995C51C1A7EA88C57C7E48F20972
                                                                                                                                                                                                                                SHA1:5F3406889CE0F05C6F115B53EB56D20425B290FA
                                                                                                                                                                                                                                SHA-256:0EC34F491CFFBDEA9B40A3EABBA73EE649B99CE0543743DC91DBB8FCAAF510D9
                                                                                                                                                                                                                                SHA-512:897F79DA1A5F8DCD916372599E99794C4566F66E61F9DE16623E5F890D3C7E4E5AB258331BB77359C5D1F0777C81E2F40AA9C6EEC7D3DA5806FA25C4E1CC5796
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......\...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.4704706933585161
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBg31tFa:v7doKsKuKZKlZNmu46yjxg31tFa
                                                                                                                                                                                                                                MD5:F69D7C1E7D9D0C625D1ACF51EF30BBC8
                                                                                                                                                                                                                                SHA1:90CA9DF9ECCD72D8034B82D0DDE60BC7FA9840C5
                                                                                                                                                                                                                                SHA-256:33CB4D73DFC5A46CD72AE4D2BC7A8F4572C09708B25E32D3E0C0AD418DD38A4B
                                                                                                                                                                                                                                SHA-512:15E32724855010398CAFFB1810838F8CE4F71A5CAB0529B71057F1ED7EE2C30D847C9E9983C9A393437B27770DD877BC803B1AE0E04994112A2E81A11D6E7689
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):8720
                                                                                                                                                                                                                                Entropy (8bit):0.17411411655429296
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:K1/lNllHXtXl7TiZ74l+hg/r/DSLUxGTKSS4UxGTkQfnKxVix:Q9lfiF4f2LUxGFdUxG10Vix
                                                                                                                                                                                                                                MD5:457238B4A9AB9AC8A7475C67887926A4
                                                                                                                                                                                                                                SHA1:7B683C13FA06009500F0EF1A41CC1E43C72B7D77
                                                                                                                                                                                                                                SHA-256:25ACAF849F61F49561DA450CCF97CDA6210F1FB3048968BF93ADECE5E6E11313
                                                                                                                                                                                                                                SHA-512:D6F68748DE4ACBE123313DF24A7290C8EBE5B51C459658B85D2ABC0C385BF88C10CF9A2C37F2EF6DD8920378C70250ECF11D3E45E0911708DA4E8011F595F825
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..............'.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11755
                                                                                                                                                                                                                                Entropy (8bit):5.190465908239046
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                                                                                                                                                                MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                                                                                                                                                                SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                                                                                                                                                                SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                                                                                                                                                                SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9ceeb3e-23fb-4501-93e9-98b513ecf6a8.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9409
                                                                                                                                                                                                                                Entropy (8bit):5.102503517876817
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:st+z+kdPaIs1SsZihUkG73o88bV+Fd2LQA66WQQI1aFIMYRoPCiYJ:st+z+IaIs1Sfh+GbGdOQx6WQQI1aTYRn
                                                                                                                                                                                                                                MD5:381CE15D1F98E2816B6AD5CAD703757E
                                                                                                                                                                                                                                SHA1:33AB79E634CD7F89153F0859BB25B75119C325B1
                                                                                                                                                                                                                                SHA-256:6A04F68CBBCB1F5382911DE5E066FE943582E2C257CC26BC79628F93E083ABC1
                                                                                                                                                                                                                                SHA-512:82CA65DB314B2AF7350D9757094A61AD42854C3B53807FA04A506D098014A630205679BC2B522D9431F2C76E0F41D8DF7F8FD112BDE9C89813022E130B06F9BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\106c965b-46ec-463f-9c65-721cff4f7a57\0

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:exported SGML document, ASCII text, with very long lines (2222)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3403059
                                                                                                                                                                                                                                Entropy (8bit):5.587037002028163
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:3FITo4nCn1uL0TRzNkEmFKVHL/2rcS0UmM/nDecu+0ZXKi0ghRVHXciaYkp:+Tob9LU
                                                                                                                                                                                                                                MD5:D66F15D779A59C62DDA84FB4A4E99DC8
                                                                                                                                                                                                                                SHA1:E439C396962F5B0C456AD7A9D8C5E262346260B3
                                                                                                                                                                                                                                SHA-256:C3C4248A6B7877F2288E9C726D7CDE3BA4A0864D83945D3EE886156A3D0B5C7A
                                                                                                                                                                                                                                SHA-512:1AA270DBD8D293CECDB6493878DCBAB9A7F0076A2DAA774E4E3D60BE0DF19CCB6B94DDE23FB20B5086EE45F8638EAC9962C40B987A65BA21EFE0BEFE5780A067
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:;c.call(b,d.content.cloneNode(!0),a.content.firstChild);return asc=a},{mode:HD()?0:1});var csc;var dsc;var esc=ca(["background-color:",";"]),fsc=function(){return M.apply(this,arguments)||this};.n(fsc,M);fsc.prototype.computeThumbnailStyle=function(a){if(a&&(a=kC(a)))return Ph(esc,a)};.var gsc=fsc;u([N(X.YtRendererBehavior),w("design:type",Object)],gsc.prototype,"rendererBehaviors",void 0);u([P(),w("design:type",Object)],gsc.prototype,"data",void 0);gsc=u([Q({disableElementRegistration:!0,is:"ytd-hashtag-tile-renderer"})],gsc);.V(gsc,"ytd-hashtag-tile-renderer",function(){if(void 0!==dsc)return dsc;var a=document.createElement("template");L(a," css-build:shady--> css-build:shady--><div id=\"content-section\" class=\"style-scope ytd-hashtag-tile-renderer\"><div id=\"thumbnail-section\" class=\"style-scope ytd-hashtag-tile-renderer\"><a class=\"hashtag-link yt-simple-endpoint style-scope ytd-hashtag-tile-renderer\" href$=\"[[computeHref_(data.onTapCommand)]]\" data=\"[[data.onTapCo

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c6093212-e00f-4922-a6a6-d30b2a6c8244.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:very short file (no magic)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1
                                                                                                                                                                                                                                Entropy (8bit):0.0
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:L:L
                                                                                                                                                                                                                                MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                                                SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                                                SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                                                SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):28672
                                                                                                                                                                                                                                Entropy (8bit):0.3410017321959524
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                                                                                                                                                                                                MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                                                                                                                                                                                                SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                                                                                                                                                                                                SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                                                                                                                                                                                                SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f1ea3b05-f76c-4394-9afd-2c0d01dccf74.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):14178
                                                                                                                                                                                                                                Entropy (8bit):5.226289692747575
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:st+z+LAoRuQaIs1SfhyqNYDjIdbGq9Cb45V2ULjkEw6WQ6TI1aTYR4y:sTcoRu1SfDbG1HlqaTYP
                                                                                                                                                                                                                                MD5:C2CBF81AA7A50CBE9329EA4D43D7AF47
                                                                                                                                                                                                                                SHA1:B8F76A9CE41ED530178719282DFDBCC89A643A3A
                                                                                                                                                                                                                                SHA-256:5C6A0DDD56B6E259BEB5BA2197A0036074D6200ADE52BFA6595DF71AC6CF934B
                                                                                                                                                                                                                                SHA-512:A6F3FE2F60316AB65E4129E07951ED0EBF7F7D4A4D2FF9EAB3196EC9753CB241F23EA06486AD0939D51BD1DA8AC0E1E435D33F0856C91BC88CBFBA48A03F2658
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352953159948904","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117794":{"last_path":""},"380c71d3-10bf-4a5d-9a06-c932e4b7d1d8":{"last_path":""},"3a2f4dee-d482-4ef8-baef-cb22b6496

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f2765864-a6b4-4529-909e-054624626d09.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):25012
                                                                                                                                                                                                                                Entropy (8bit):5.567210469520057
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:diMUsaWPScfaN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCDfrtrw0opdBtuH:diMUsaWPScfaNu1jarLrWlt4
                                                                                                                                                                                                                                MD5:392DC9DB13CD15613527730027AD77C1
                                                                                                                                                                                                                                SHA1:64637ABCFB6A822AEAD4338ABF30BC4A5F2494E6
                                                                                                                                                                                                                                SHA-256:00BF989CA1B91903D690E160F57B31FE773C15DFF9767DF8735356399AA0600C
                                                                                                                                                                                                                                SHA-512:4C4056D6D64D764ED0B0C59408CCC04B1690709C2D10FB174BBABB082F2DD2B1BC9044158932D078AA5AC451A0BCA6725C89B346D7C325ABB8E1157E1C9C5E73
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352953158855283","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352953158855283","location":5,"ma

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f4293042-8bdd-4c4d-aac0-26c90c3f1e56.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):115717
                                                                                                                                                                                                                                Entropy (8bit):5.183660917461099
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                                                                                MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                                                                                SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                                                                                SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                                                                                SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.053939291573519337
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:GtStut10NWIPStut10NstYR9XCChslotGLNl0ml/Vl/XoQXEl:MtYWIRtYkYLpEjVl/PvoQ
                                                                                                                                                                                                                                MD5:58C5A88647318167FC1A3CBAC2DC9DFE
                                                                                                                                                                                                                                SHA1:67ACE58D7581CB71ACCED7DA4668307208348A74
                                                                                                                                                                                                                                SHA-256:88115B67F5576C11DCC1C9705F95BB5340328875BE9BC60C109B2C4EACB09682
                                                                                                                                                                                                                                SHA-512:70BCB3C0FB3C2BA8D6E565760E99E624F7B944207D330B952D33357E075B9F6EEF42EEDBB1BD3355B4B19A8CC11D5F3E7104F9954244EAFD06DC325E43BD2889
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................]....!3..4..}..t.f.......-.....................]....!3..4..}..t.f.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):86552
                                                                                                                                                                                                                                Entropy (8bit):0.8722828146036011
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:jjx7/02b2dNshTNsOO5NsvlNsE7g0B0qmqgq:jt7/02b2oMqvQERW2
                                                                                                                                                                                                                                MD5:AD70DE47EFEA146C337FBE833F80D91C
                                                                                                                                                                                                                                SHA1:6657DB93E9D654736797E763D279010A94FD1870
                                                                                                                                                                                                                                SHA-256:880F4441057DE75A233AD7C7CE7964083C23A8AA3183DE8CC04B3F50E3AF1F9A
                                                                                                                                                                                                                                SHA-512:9809390EDF3E936E52C6C8B0188D94C912376585F65D0C567997B9DF618AAA7F4EF62E1EE619502EDCCF4CDEE5273A28A4DBF84381590D20A5954F6704760FBA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):611
                                                                                                                                                                                                                                Entropy (8bit):2.8521850318721054
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:/XntM+iTl3sedhOKOuuuuuuuuuuuuuuuuuuuuuuuuu:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuuuu
                                                                                                                                                                                                                                MD5:C3DE6ECC9CB6E0B38763C16AF5D17212
                                                                                                                                                                                                                                SHA1:5939AA8862220F76A5F8E8459E6D972B93996AE7
                                                                                                                                                                                                                                SHA-256:9B9A99E6A3A50892194CEF1D62336D58C6557CA5FD958137169B9811B1893D82
                                                                                                                                                                                                                                SHA-512:EADE7CD254DCF81CD0D0654D1159E862B39316D7CD2BA5EB9F63B41A023F835B4E23F08D5709C9FC00B0F0ED06EDD6ABBEBC4EF0EB987F63D40F254E03B5C95B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.143644380976903
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bAL4q2P923oH+TcwtfrK+IFUt8KR9b/XQJZmw+KR9bzADkwO923oH+TcwtfrF:roMv4Yeb23FUt8KHC/+K7u5LYeb3J
                                                                                                                                                                                                                                MD5:47BABCA01E7C44E4697ACC635355206B
                                                                                                                                                                                                                                SHA1:097DE427938F0A8E58AAEC064F122C1C66C566CC
                                                                                                                                                                                                                                SHA-256:2E3FB911CAC4109D86376243AAB3E69AB9F40D9A8F27C932BEC50C2F348E880D
                                                                                                                                                                                                                                SHA-512:F586EC617BB186F00BCF7FDE96FCF33135CCBB7251C37A1678F67B27561052516F7BFB099989FD10C01C03BFEC1A618021E72C0890F007F13A566530BD0D0BD2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.026 28e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/02/21-02:39:20.033 28e4 Recovering log #3.2024/02/21-02:39:20.037 28e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):5.143644380976903
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bAL4q2P923oH+TcwtfrK+IFUt8KR9b/XQJZmw+KR9bzADkwO923oH+TcwtfrF:roMv4Yeb23FUt8KHC/+K7u5LYeb3J
                                                                                                                                                                                                                                MD5:47BABCA01E7C44E4697ACC635355206B
                                                                                                                                                                                                                                SHA1:097DE427938F0A8E58AAEC064F122C1C66C566CC
                                                                                                                                                                                                                                SHA-256:2E3FB911CAC4109D86376243AAB3E69AB9F40D9A8F27C932BEC50C2F348E880D
                                                                                                                                                                                                                                SHA-512:F586EC617BB186F00BCF7FDE96FCF33135CCBB7251C37A1678F67B27561052516F7BFB099989FD10C01C03BFEC1A618021E72C0890F007F13A566530BD0D0BD2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:20.026 28e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/02/21-02:39:20.033 28e4 Recovering log #3.2024/02/21-02:39:20.037 28e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):787
                                                                                                                                                                                                                                Entropy (8bit):4.059252238767438
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
                                                                                                                                                                                                                                MD5:D8D8899761F621B63AD5ED6DF46D22FE
                                                                                                                                                                                                                                SHA1:23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
                                                                                                                                                                                                                                SHA-256:A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
                                                                                                                                                                                                                                SHA-512:4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.|.................9_.....'\c..................9_.......f-.................__global... .|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):342
                                                                                                                                                                                                                                Entropy (8bit):5.161894209819256
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bN4vAL4q2P923oH+TcwtfrzAdIFUt8KR9bNpJZmw+KR9bNoQDkwO923oH+Tc/:rF4YMv4Yeb9FUt8KFD/+KFx5LYeb2J
                                                                                                                                                                                                                                MD5:3708417DF643C1605A05B1B28C53D9DD
                                                                                                                                                                                                                                SHA1:9E8D32CAC85844ED23F365B45497DD5D6274DE0A
                                                                                                                                                                                                                                SHA-256:FF2C3D8C38CC68E0B6981024C10A931C86307C1BCDCBD25ED4BA414BBD85C382
                                                                                                                                                                                                                                SHA-512:A836CF455577F74D8011F1E7D0238446C64AB63A5E8CE760D9F47FCE2F67DC1DD1D085F3EB3EADE0A62F83417B368B0A21E7632CF1F3475CE32ECD5981A694CE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:19.988 28e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/02/21-02:39:19.991 28e4 Recovering log #3.2024/02/21-02:39:19.999 28e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):342
                                                                                                                                                                                                                                Entropy (8bit):5.161894209819256
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:rR9bN4vAL4q2P923oH+TcwtfrzAdIFUt8KR9bNpJZmw+KR9bNoQDkwO923oH+Tc/:rF4YMv4Yeb9FUt8KFD/+KFx5LYeb2J
                                                                                                                                                                                                                                MD5:3708417DF643C1605A05B1B28C53D9DD
                                                                                                                                                                                                                                SHA1:9E8D32CAC85844ED23F365B45497DD5D6274DE0A
                                                                                                                                                                                                                                SHA-256:FF2C3D8C38CC68E0B6981024C10A931C86307C1BCDCBD25ED4BA414BBD85C382
                                                                                                                                                                                                                                SHA-512:A836CF455577F74D8011F1E7D0238446C64AB63A5E8CE760D9F47FCE2F67DC1DD1D085F3EB3EADE0A62F83417B368B0A21E7632CF1F3475CE32ECD5981A694CE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:2024/02/21-02:39:19.988 28e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/02/21-02:39:19.991 28e4 Recovering log #3.2024/02/21-02:39:19.999 28e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):120
                                                                                                                                                                                                                                Entropy (8bit):3.32524464792714
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                                                                                                                                                                MD5:A397E5983D4A1619E36143B4D804B870
                                                                                                                                                                                                                                SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                                                                                                                                                                SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                                                                                                                                                                SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13
                                                                                                                                                                                                                                Entropy (8bit):2.7192945256669794
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                                                                                                MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                                                                                                SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                                                                                                SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                                                                                                SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:117.0.2045.47

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36dbf.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36e5b.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36e6b.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF370ad.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF370cc.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF370dc.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37204.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37224.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37679.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39cfc.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3db5d.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dca5.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dd70.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40461.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46212.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF462cd.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46398.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF489dd.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF492c6.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4a97b.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c64a.TMP (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44137
                                                                                                                                                                                                                                Entropy (8bit):6.0907342617188345
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMHwuF9hDO6vP6O+Ytbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynED6Ztbz8hu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:56042B45D32FE9C190798787D47F2D74
                                                                                                                                                                                                                                SHA1:AEE843C41E0461055907DDA95B9EDB38C8F78E40
                                                                                                                                                                                                                                SHA-256:77BCD27AA532A77897D1A7050BA66CB01DD99D56BBC1ACF33E8D613150CF869A
                                                                                                                                                                                                                                SHA-512:85DC5704287C344DC6F5DA42631946669E03C647DE01A077B00714CA9D848C51B2AC793C8B232BAA53E56549274D601CF0F7880A15EBDDFC53B76C3E1A25047E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):47
                                                                                                                                                                                                                                Entropy (8bit):4.3818353308528755
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                                                                                                                                                                                                MD5:48324111147DECC23AC222A361873FC5
                                                                                                                                                                                                                                SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                                                                                                                                                                                                SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                                                                                                                                                                                                SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):35
                                                                                                                                                                                                                                Entropy (8bit):4.014438730983427
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                                                                                                                                                                                                MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                                                                                                                                                                                                SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                                                                                                                                                                                                SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                                                                                                                                                                                                SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"forceServiceDetermination":false}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):50
                                                                                                                                                                                                                                Entropy (8bit):3.9904355005135823
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                                                                                                                                                                                                MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                                                                                                                                                                                                SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                                                                                                                                                                                                SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                                                                                                                                                                                                SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):575056
                                                                                                                                                                                                                                Entropy (8bit):7.999649474060713
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                                                                                                                                                                                                MD5:BE5D1A12C1644421F877787F8E76642D
                                                                                                                                                                                                                                SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                                                                                                                                                                                                SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                                                                                                                                                                                                SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):86
                                                                                                                                                                                                                                Entropy (8bit):4.3751917412896075
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YQ3JYq9xSs0dMEJAELJ2rjozQmn:YQ3Kq9X0dMgAEwjA
                                                                                                                                                                                                                                MD5:CDDDC745A8C954DC438C931889999BDB
                                                                                                                                                                                                                                SHA1:7908F975B6815460CAA2BC3438EFBD8FC8D36211
                                                                                                                                                                                                                                SHA-256:3DC9043838386F5363AC96A01477CF3163B5118B80191576A11B32CE9894314C
                                                                                                                                                                                                                                SHA-512:3D2D4852AA2AC6CB0B9B6CBCA9F04366AFD48D362D869BE877EF324C16D72FF119B5842891BAA2B6B99DF2DE2DB8D3BE5C23F0F97F8943BD74195996BCB66A0A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":4}

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a043efa2-5a08-43f5-b26b-f671a5dcf5fa.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):43746
                                                                                                                                                                                                                                Entropy (8bit):6.096052494721234
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBNwulhDO6vP6Oq3Ikxs7FbcGoup1Xl3jVzXr4CCAt:z/Ps+wsI7ynE26CIkxichu3VlXr4CRoA
                                                                                                                                                                                                                                MD5:B49ADDDF11C7596D4CCA2C75E3BE7570
                                                                                                                                                                                                                                SHA1:3E39605B390DA278E4463F0874B19789CDA585CA
                                                                                                                                                                                                                                SHA-256:CB4B56301684F9DA003F74260BC2E79A402F5304FCA05D1D632739DDF5B07BFE
                                                                                                                                                                                                                                SHA-512:30C7556C71E2EBDB626F9645FB372735666CC7BA5065700FB6012D9145FAFF3AC0DA112A9FDF9D32E226B0C8B16D9E95ECEA306F227C49C3D52E20554F799B95
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a0c897e7-4939-4b6b-805d-babb8f847378.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44063
                                                                                                                                                                                                                                Entropy (8bit):6.090488563351633
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+Otbzy70FqHoPFkGoup1Xl3jVH:z/Ps+wsI7ynEZ6ntbz8hu3VlXr4CRoA
                                                                                                                                                                                                                                MD5:E8102A5B86DC0DE1D5B11904F3646314
                                                                                                                                                                                                                                SHA1:4BAA840FD511E0376959647C12EC5CB1E54BC4D7
                                                                                                                                                                                                                                SHA-256:9A801D968A93D45324EB6699548ADEAE314E895AC5285CB39ABCA9DD94527BE9
                                                                                                                                                                                                                                SHA-512:29D530CE846D88E90C54EA32B6C8D5F2A750E20F5EA4E6D5658E2EC8BFDB0C5522CEAE4D913AED950F4EC1A1BB0E92134CA2D8E2F58884D809E5B97EBA0140C6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a41280dc-8f1f-4015-974e-0f8a0ad08c38.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                                                Entropy (8bit):5.796748210366973
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:j8Ni7YJNzQ1Uy/MD9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:j9sHPsOhDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:24F5CCADCBB7D274F6EB404434D718D8
                                                                                                                                                                                                                                SHA1:95E5D9FB012BEE4A8CA9A11F9BBCD75B75EE023F
                                                                                                                                                                                                                                SHA-256:C85B5B027B5AD6E59F4098DF255C28CE7CF8BEC88D83C895A7557A5BCA9A7659
                                                                                                                                                                                                                                SHA-512:FE31BED6960A49503A7DBD1F86A06157897DA95372A3B871FD1D18812145AFB838385362F888E92871978F85BE5D6D39B3A14351FAB30BF4A995C0BE75E33CDC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b2a863d0-9dc5-48e5-a0b9-4509225f10e3.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44596
                                                                                                                                                                                                                                Entropy (8bit):6.096117663359574
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBLwuQhDO6vP6OFHcfWFQndcGoup1Xl3jVzXr4CCAg:z/Ps+wsI7ynEV6mjchu3VlXr4CRo1
                                                                                                                                                                                                                                MD5:EDED1C1F6D4964E68209A574A541E57E
                                                                                                                                                                                                                                SHA1:ECB785208CD247C3706CD793688AE3B9A4E5FED8
                                                                                                                                                                                                                                SHA-256:E71069550BC2971C04BAFA7F7AA13A63DB3C48597BC2FF7949949C3F94C60ACC
                                                                                                                                                                                                                                SHA-512:1E6A721D3377B8DF90F412B7AA421AFF26C6E33B349143B34DCD88C91622E5FE6EC9B20F4B261A9651C1AC2B6AB317109282CEE14EDE359D2371D6655272AF65
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c0174f8f-1193-464b-ab59-bcf99eae1fd4.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                                                Entropy (8bit):5.797103775260034
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:/8Ni7nKzQ1Ue/Mj9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:/92PI+hDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:4D2AECE82CDCDB77B6EEB7A441354463
                                                                                                                                                                                                                                SHA1:B05C83B7AF001EF5F0E09F9CDD33CF8687366D7E
                                                                                                                                                                                                                                SHA-256:A978C12ADECF1A9F4717DAF7D364273F705E30664723E69B92A7865EC8431C72
                                                                                                                                                                                                                                SHA-512:93B55FFD4EE86C9AE5388139B51D2C63508290F536A270A5E7128067EE271BD316CD6B67D58D60E1E8FAB9BA561DEC3C7B6522E462F6D5539E7EFCC79D9F1BF7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"01B3FBF4C85FEC53B75C6EC99EA8828137261259721C4770847EA19FB060264D\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c0e1d9c4-cdea-4bb5-8be5-c3ebd0b47706.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):44063
                                                                                                                                                                                                                                Entropy (8bit):6.090503828580798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kkBMmwuF9hDO6vP6O+Mtbzy70FqHoPFkGoup1Xl3jVa:z/Ps+wsI7ynEs6htbz8hu3VlXr4CRo5
                                                                                                                                                                                                                                MD5:79B6422170055DCCA45DBAE44A206BF8
                                                                                                                                                                                                                                SHA1:878CC9CC0C97A0CCC5AEE788E445EAAEBA20A501
                                                                                                                                                                                                                                SHA-256:AE480664D4173FAD70E1F0B8F830FC71DBFF97B3EF554E0B61DF9967EAEA7B53
                                                                                                                                                                                                                                SHA-512:59B4DBEC05C25D56CC5560B8F8D3D44C024F4DFE725A10536E4532DE61779B3100401A3A2228E0E34E788703B29961A8C72D4506782F1B89DCCE316F95453A19
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d5a2f44e-dcce-4a4f-acb2-d05dea52f4e7.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19912
                                                                                                                                                                                                                                Entropy (8bit):5.795950259500807
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:W78Ni7nKzQ1UK/M39hamJfk6vP6Oq3IkwmdK899F6GRQ9CbMoqRuX8B1sYQu:c92PU6hDO6vP6Oq3IkxRTF6GSCAos
                                                                                                                                                                                                                                MD5:96EE410470CC0538BA63BF8862B13731
                                                                                                                                                                                                                                SHA1:91DCEF2A75ADD60A067DAED5F86B32F53438E105
                                                                                                                                                                                                                                SHA-256:6990EEC64618C75467264771171CD9CEE50F5E4157D17B6040DADB3F60A2BC51
                                                                                                                                                                                                                                SHA-512:B05A7A0BEF62CE8688F1976E3AD3A16D1EE03E76214D0455CF5997D81D743B8BC4AB08B96BD045A22DC67C37EA5E5E66B40A03A6F3D04B4FE196C47BC5A877BE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"01B3FBF4C85FEC53B75C6EC99EA8828137261259721C4770847EA19FB060264D\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"consumer_mode":{"ie_usage_checked":"13352953228941632","ie_usage_times":[]},"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_sta

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f6d2501f-4949-4f10-8319-e49bbb619d76.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19833
                                                                                                                                                                                                                                Entropy (8bit):5.796831717440752
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:j8Ni7YJNzQ1Uk/MP9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:j9sHPGahDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:E5539FC487505AF2AF2FF32BB0328DE8
                                                                                                                                                                                                                                SHA1:56902A97A87C508C637BEF73C07251828A8E5EB6
                                                                                                                                                                                                                                SHA-256:60D6B9F2D2A74A1B95916CF0BA932E605597B13C92E56674746AD7A7EBBD2770
                                                                                                                                                                                                                                SHA-512:243A0909E9E7B1CB889B3068AC96AD5FC9CF33E9B066A2C9DFD85794E2E84C2EBEF9845A7DE13192A821853E8D656122928CC773D5B1AA0201C5141D944DD99C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1708479582"},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f8b04c26-8595-447c-bc25-182424efaa81.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):19754
                                                                                                                                                                                                                                Entropy (8bit):5.798283984761439
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:98Ni7YJNzQ1Uy/MD9hamJfk6vP6Oq3IkwmdKd99F6GRQ9CbMoqRuX8B1sYQu:99sHPsOhDO6vP6Oq3IkxITF6GSCAos
                                                                                                                                                                                                                                MD5:A07C4CCDD07628E10FF097034C501E1B
                                                                                                                                                                                                                                SHA1:85BABE9BD9052FF283629CB8C22B4CF26C39BE6B
                                                                                                                                                                                                                                SHA-256:997BCB4FE24AE5BD8877D66E6547A9665FE2618BF12E86A5155EFD60302589E4
                                                                                                                                                                                                                                SHA-512:627ECF8B170322FB3CA4B309047AB106BAC13A70DA201D80CF2EEC8913D805948C20435211EE73C01D7E876198FA2C0AEEBCD52DF5ECC3B642B821B9C6443E45
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAAMAAAAAAAAAAAA=","dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"edge_ci":{"metrics_bookmark":"\u003CBookmarkList Direction='backward'>\r\n\u003C/BookmarkList>","num_healthy_bro

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2278
                                                                                                                                                                                                                                Entropy (8bit):3.845794448822307
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:uiTrlKxrgxGxl9Il8uer7MaWklZSvbg135Ahd1rc:mnYY7BWklIvk135AC
                                                                                                                                                                                                                                MD5:EC26051B01215938EF1E65C833135049
                                                                                                                                                                                                                                SHA1:EEA18A8997D1AADC02765A19C2DAAAC5C348D397
                                                                                                                                                                                                                                SHA-256:09A1122D9CB44BDFEB07ED470CCBFEA3AB62AAFC79A0C45ACF3BE5EBF075B9B2
                                                                                                                                                                                                                                SHA-512:8993AEE1976A2135AAB5B6478655E498F050F25A311460902667C437F6B14FCEB7BC48D5BD77D8CEA719E0B83A5673F6AC5814F9C116AD8B373A4C968F09D3C6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.F.n.7.L.2.9.k.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.0.X.h.k.n.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4622
                                                                                                                                                                                                                                Entropy (8bit):4.000046416887815
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:C7YutrN8gE5RXJqm8M42o15JAfF11YHBKJO/z7ukmA7v:C7VJSgUCr5JAN1OhwCDD
                                                                                                                                                                                                                                MD5:4B4C12030B66485D2FD291E8B4B7E8DC
                                                                                                                                                                                                                                SHA1:18034ABCAB3F4CD82A6C8844F45DB5ED733027F7
                                                                                                                                                                                                                                SHA-256:105A121D62322EAE6B52FDDFF611F225650367C6E0F1D1888619C338C0914DB1
                                                                                                                                                                                                                                SHA-512:4E55AA545ED7B313ACD51C4A0F23C2CBB4EC15D1416F3FB3C48144DB313CABE047A2E070F612DE5024BD1F229A42454988BD794B6B185591268DF81B747C8EDD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".i.r.L.e.F.W.d.k.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.v.0.X.h.k.n.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\fu[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                                                Entropy (8bit):6.5811137693371
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETr:SqDEvCTbMWu7rQYlBQcBiT6rprG8akr
                                                                                                                                                                                                                                MD5:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                SHA1:808687F484CE82B23CF51886137375CC653DF1E5
                                                                                                                                                                                                                                SHA-256:28723F409F4861694F491BAEE325FB96AF0A52B7E2DB8378D8CFC342E3AB1DE2
                                                                                                                                                                                                                                SHA-512:D411FCED7D8FE40CA331D3CD405A4DD48E6C45B8640E9A68E136539296D8712FB4E45BA510FE480B02692DE3E2162A58F389DB34FC5D2536CDF58BDD701FECED
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 33%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...t@.e.........."..........R......w.............@..........................`......H.....@...@.......@.....................d...|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\ladas[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2363904
                                                                                                                                                                                                                                Entropy (8bit):7.962536812435418
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:zO/TJOsOiwul5jDwrMdS9hwLsV70KS+MWUPQjCxa:zEwS5j8raRLsW3zsC8
                                                                                                                                                                                                                                MD5:89C788DA1AF63946AA34AB15828E4BDC
                                                                                                                                                                                                                                SHA1:0B1113A1B6946990805559C15E5EE5C1771F73B2
                                                                                                                                                                                                                                SHA-256:A20F20FF15142CEF0B6AF5824830F31352148C61142899EDFE920737A208DF9C
                                                                                                                                                                                                                                SHA-512:5F949CF415AEFAD92CDA3148A03F74FD6AA5C3EBF194B4EF16283BBF153E7381E0AA189D5E21E0EBDA12EF24711618E0A80D2D3CE263B80D9D578BDEA35D171B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 53%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V........Z...........@.......................... [.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@,.........................@...jsijvwkm......@.....................@...qxzfqftw......Z.......#.............@....taggant.0....Z.."....#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\niks[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1737216
                                                                                                                                                                                                                                Entropy (8bit):7.943274695914565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:ChvOpUNaR4SACjznpPE3H+ZN2c6FbyOxHrPVbKndtwY:CFOChCpPs6N291LBh
                                                                                                                                                                                                                                MD5:B8F1CE54E96098880401F6A0C2AD274C
                                                                                                                                                                                                                                SHA1:C61FEE97FA06FB06625CFA658CB575D43EE4DB6E
                                                                                                                                                                                                                                SHA-256:35F1DEE6F4326EC10D5E98510BBAD3F2ED362FCFB59B82D6589B32BCE7EF3F17
                                                                                                                                                                                                                                SHA-512:437B82376EFBA5C450D535564BF4762AE231401BD943BB1EB765664CAE27A79B2D4F238A41CF8D1EE831E3AA6776E10D23650A085BE7508FA6F6B4F7D2841682
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 56%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$...........`E.. ...`....@.. ........................E.....s.....`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... .`*..........8..............@...rgatmioc.`....+..F...:..............@...ibjqbcyw. ...`E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\well[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                                                Entropy (8bit):7.035577580267798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8au62+b+HdiJUC:ZTvC/MTQYxsWR7au62+b+HoJU
                                                                                                                                                                                                                                MD5:B6B6A5E38DCEB1ED672ED3C1112BEC71
                                                                                                                                                                                                                                SHA1:ABA884ABDB03F5308687F42C2CA446D895BA99A7
                                                                                                                                                                                                                                SHA-256:48F95C946E797E8C5166223623484859CFAA1960EC5623D9929A65A6CE2BBFBC
                                                                                                                                                                                                                                SHA-512:110B27238A7E37189CE5B4F4404C70EC58F28B9BA570DE04D76B30EDD6E86A45C0D7155D84DE2D92CC9FF648AC82369B786D3717682DB7E20392525D5142B704
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 29%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...v@.e..........".................w.............@..........................0............@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\amert[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 60%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\ladas[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):2363904
                                                                                                                                                                                                                                Entropy (8bit):7.962536812435418
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:zO/TJOsOiwul5jDwrMdS9hwLsV70KS+MWUPQjCxa:zEwS5j8raRLsW3zsC8
                                                                                                                                                                                                                                MD5:89C788DA1AF63946AA34AB15828E4BDC
                                                                                                                                                                                                                                SHA1:0B1113A1B6946990805559C15E5EE5C1771F73B2
                                                                                                                                                                                                                                SHA-256:A20F20FF15142CEF0B6AF5824830F31352148C61142899EDFE920737A208DF9C
                                                                                                                                                                                                                                SHA-512:5F949CF415AEFAD92CDA3148A03F74FD6AA5C3EBF194B4EF16283BBF153E7381E0AA189D5E21E0EBDA12EF24711618E0A80D2D3CE263B80D9D578BDEA35D171B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 53%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V........Z...........@.......................... [.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@,.........................@...jsijvwkm......@.....................@...qxzfqftw......Z.......#.............@....taggant.0....Z.."....#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\niks[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1737216
                                                                                                                                                                                                                                Entropy (8bit):7.943274695914565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:ChvOpUNaR4SACjznpPE3H+ZN2c6FbyOxHrPVbKndtwY:CFOChCpPs6N291LBh
                                                                                                                                                                                                                                MD5:B8F1CE54E96098880401F6A0C2AD274C
                                                                                                                                                                                                                                SHA1:C61FEE97FA06FB06625CFA658CB575D43EE4DB6E
                                                                                                                                                                                                                                SHA-256:35F1DEE6F4326EC10D5E98510BBAD3F2ED362FCFB59B82D6589B32BCE7EF3F17
                                                                                                                                                                                                                                SHA-512:437B82376EFBA5C450D535564BF4762AE231401BD943BB1EB765664CAE27A79B2D4F238A41CF8D1EE831E3AA6776E10D23650A085BE7508FA6F6B4F7D2841682
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 56%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$...........`E.. ...`....@.. ........................E.....s.....`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... .`*..........8..............@...rgatmioc.`....+..F...:..............@...ibjqbcyw. ...`E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\plaza[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3049984
                                                                                                                                                                                                                                Entropy (8bit):7.97589377359469
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:6yGfIYR5y+pQmTaqFGRhkqftySo8Rqh7L274FFT64A58zydqI2X:67f5HpQmejXI18EfFFT64EsydqI2
                                                                                                                                                                                                                                MD5:0F243E46BF152C0E016F7C1A54BD27BB
                                                                                                                                                                                                                                SHA1:1CA165A3AF57A357B9FB5C402C44326026A733E1
                                                                                                                                                                                                                                SHA-256:76D16F92EFC5673518417B2055F6F69140425EAF0223A923B6FCA79AAB65460D
                                                                                                                                                                                                                                SHA-512:4401D896307877CD227C3DBB813666A255289DC3BCCDF1353546294E9A1366F9FC73ECBAE0CB5EB88592ED4718176E8CFBA97AA0A906A981F772BDA651B6BADF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 55%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>.......X............@..........................p............@... .. .... .. .......... ...L...l...x....................................................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........x.. ...(..................@....data.....!.......!.................@...................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\well[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                                                Entropy (8bit):7.035577580267798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8au62+b+HdiJUC:ZTvC/MTQYxsWR7au62+b+HoJU
                                                                                                                                                                                                                                MD5:B6B6A5E38DCEB1ED672ED3C1112BEC71
                                                                                                                                                                                                                                SHA1:ABA884ABDB03F5308687F42C2CA446D895BA99A7
                                                                                                                                                                                                                                SHA-256:48F95C946E797E8C5166223623484859CFAA1960EC5623D9929A65A6CE2BBFBC
                                                                                                                                                                                                                                SHA-512:110B27238A7E37189CE5B4F4404C70EC58F28B9BA570DE04D76B30EDD6E86A45C0D7155D84DE2D92CC9FF648AC82369B786D3717682DB7E20392525D5142B704
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 29%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...v@.e..........".................w.............@..........................0............@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ladas[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2363904
                                                                                                                                                                                                                                Entropy (8bit):7.962536812435418
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:zO/TJOsOiwul5jDwrMdS9hwLsV70KS+MWUPQjCxa:zEwS5j8raRLsW3zsC8
                                                                                                                                                                                                                                MD5:89C788DA1AF63946AA34AB15828E4BDC
                                                                                                                                                                                                                                SHA1:0B1113A1B6946990805559C15E5EE5C1771F73B2
                                                                                                                                                                                                                                SHA-256:A20F20FF15142CEF0B6AF5824830F31352148C61142899EDFE920737A208DF9C
                                                                                                                                                                                                                                SHA-512:5F949CF415AEFAD92CDA3148A03F74FD6AA5C3EBF194B4EF16283BBF153E7381E0AA189D5E21E0EBDA12EF24711618E0A80D2D3CE263B80D9D578BDEA35D171B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 53%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V........Z...........@.......................... [.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@,.........................@...jsijvwkm......@.....................@...qxzfqftw......Z.......#.............@....taggant.0....Z.."....#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\plaza[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3049984
                                                                                                                                                                                                                                Entropy (8bit):7.97589377359469
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:6yGfIYR5y+pQmTaqFGRhkqftySo8Rqh7L274FFT64A58zydqI2X:67f5HpQmejXI18EfFFT64EsydqI2
                                                                                                                                                                                                                                MD5:0F243E46BF152C0E016F7C1A54BD27BB
                                                                                                                                                                                                                                SHA1:1CA165A3AF57A357B9FB5C402C44326026A733E1
                                                                                                                                                                                                                                SHA-256:76D16F92EFC5673518417B2055F6F69140425EAF0223A923B6FCA79AAB65460D
                                                                                                                                                                                                                                SHA-512:4401D896307877CD227C3DBB813666A255289DC3BCCDF1353546294E9A1366F9FC73ECBAE0CB5EB88592ED4718176E8CFBA97AA0A906A981F772BDA651B6BADF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 55%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>.......X............@..........................p............@... .. .... .. .......... ...L...l...x....................................................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........x.. ...(..................@....data.....!.......!.................@...................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\well[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                                                Entropy (8bit):7.035577580267798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8au62+b+HdiJUC:ZTvC/MTQYxsWR7au62+b+HoJU
                                                                                                                                                                                                                                MD5:B6B6A5E38DCEB1ED672ED3C1112BEC71
                                                                                                                                                                                                                                SHA1:ABA884ABDB03F5308687F42C2CA446D895BA99A7
                                                                                                                                                                                                                                SHA-256:48F95C946E797E8C5166223623484859CFAA1960EC5623D9929A65A6CE2BBFBC
                                                                                                                                                                                                                                SHA-512:110B27238A7E37189CE5B4F4404C70EC58F28B9BA570DE04D76B30EDD6E86A45C0D7155D84DE2D92CC9FF648AC82369B786D3717682DB7E20392525D5142B704
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 29%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...v@.e..........".................w.............@..........................0............@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 60%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\amert[2].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 60%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                                                Entropy (8bit):6.5811137693371
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETr:SqDEvCTbMWu7rQYlBQcBiT6rprG8akr
                                                                                                                                                                                                                                MD5:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                SHA1:808687F484CE82B23CF51886137375CC653DF1E5
                                                                                                                                                                                                                                SHA-256:28723F409F4861694F491BAEE325FB96AF0A52B7E2DB8378D8CFC342E3AB1DE2
                                                                                                                                                                                                                                SHA-512:D411FCED7D8FE40CA331D3CD405A4DD48E6C45B8640E9A68E136539296D8712FB4E45BA510FE480B02692DE3E2162A58F389DB34FC5D2536CDF58BDD701FECED
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 33%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...t@.e.........."..........R......w.............@..........................`......H.....@...@.......@.....................d...|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fu[2].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                                                Entropy (8bit):6.5811137693371
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETr:SqDEvCTbMWu7rQYlBQcBiT6rprG8akr
                                                                                                                                                                                                                                MD5:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                SHA1:808687F484CE82B23CF51886137375CC653DF1E5
                                                                                                                                                                                                                                SHA-256:28723F409F4861694F491BAEE325FB96AF0A52B7E2DB8378D8CFC342E3AB1DE2
                                                                                                                                                                                                                                SHA-512:D411FCED7D8FE40CA331D3CD405A4DD48E6C45B8640E9A68E136539296D8712FB4E45BA510FE480B02692DE3E2162A58F389DB34FC5D2536CDF58BDD701FECED
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 33%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...t@.e.........."..........R......w.............@..........................`......H.....@...@.......@.....................d...|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\niks[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1737216
                                                                                                                                                                                                                                Entropy (8bit):7.943274695914565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:ChvOpUNaR4SACjznpPE3H+ZN2c6FbyOxHrPVbKndtwY:CFOChCpPs6N291LBh
                                                                                                                                                                                                                                MD5:B8F1CE54E96098880401F6A0C2AD274C
                                                                                                                                                                                                                                SHA1:C61FEE97FA06FB06625CFA658CB575D43EE4DB6E
                                                                                                                                                                                                                                SHA-256:35F1DEE6F4326EC10D5E98510BBAD3F2ED362FCFB59B82D6589B32BCE7EF3F17
                                                                                                                                                                                                                                SHA-512:437B82376EFBA5C450D535564BF4762AE231401BD943BB1EB765664CAE27A79B2D4F238A41CF8D1EE831E3AA6776E10D23650A085BE7508FA6F6B4F7D2841682
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 56%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$...........`E.. ...`....@.. ........................E.....s.....`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... .`*..........8..............@...rgatmioc.`....+..F...:..............@...ibjqbcyw. ...`E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\plaza[1].exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3049984
                                                                                                                                                                                                                                Entropy (8bit):7.97589377359469
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:6yGfIYR5y+pQmTaqFGRhkqftySo8Rqh7L274FFT64A58zydqI2X:67f5HpQmejXI18EfFFT64EsydqI2
                                                                                                                                                                                                                                MD5:0F243E46BF152C0E016F7C1A54BD27BB
                                                                                                                                                                                                                                SHA1:1CA165A3AF57A357B9FB5C402C44326026A733E1
                                                                                                                                                                                                                                SHA-256:76D16F92EFC5673518417B2055F6F69140425EAF0223A923B6FCA79AAB65460D
                                                                                                                                                                                                                                SHA-512:4401D896307877CD227C3DBB813666A255289DC3BCCDF1353546294E9A1366F9FC73ECBAE0CB5EB88592ED4718176E8CFBA97AA0A906A981F772BDA651B6BADF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Antivirus:
                                                                                                                                                                                                                                • Antivirus: Virustotal, Detection: 55%, Browse
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>.......X............@..........................p............@... .. .... .. .......... ...L...l...x....................................................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........x.. ...(..................@....data.....!.......!.................@...................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\10396 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):35420
                                                                                                                                                                                                                                Entropy (8bit):5.085932193972411
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:uPtFYceo3KtwnY9nR+eXHxoZ/HJkNTBdHOT5Qhh7veKyt9KZn:seo3KtwnY9nR+eXHcHJk/dHOTij75Bn
                                                                                                                                                                                                                                MD5:9ABD1F19141EABD2D6C60829D6049802
                                                                                                                                                                                                                                SHA1:B77144286A8162CE9D2000BE400C40AE7D889A91
                                                                                                                                                                                                                                SHA-256:7112D89BBDF8AEAEED70F64F78BE5CADFEDDD7D923590E6912D58BDFF326239D
                                                                                                                                                                                                                                SHA-512:170B5A09BD11F04B68103FE3E4FEE6C51CF065FC50E9C20E581D7EA13D35DFAC44B34C0B5EA412655C7E33217B21ADACC0EF789CB8E857419A164AA713E82183
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob: chrome:; style-src 'unsafe-inline';">. <meta name="color-scheme" content="light dark">. <title data-l10n-id="newtab-page-title"></title>. <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>. <link rel="localization" href="branding/brand.ftl" />. <link rel="localization" href="toolkit/branding/brandings.ftl" />. <link rel="localization" href="browser/newtab/newtab.ftl" />. <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />. <link rel="stylesheet" href="chrome://activity-stream/content/css/activity-stream.css" />. </head>. Cached: Wed, 21 Feb 2024 01:40:39 GMT -->. <body class="activity-stream">. <div id="header-asrouter-container" role="presentation"></div>. <div id="r

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\11780 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):129
                                                                                                                                                                                                                                Entropy (8bit):5.009798892494808
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:w8HLaugWuBMqEcldnXDLwrRzJKVJ3uDLjOKf6T0tn:jLa48iclpDLwnw+TOKLtn
                                                                                                                                                                                                                                MD5:45787E4012892D0CA3C56D6F6669447A
                                                                                                                                                                                                                                SHA1:E1F0227CA909371E6E547FF35D8549BD677CD25D
                                                                                                                                                                                                                                SHA-256:14EEC3F1F2A4347D85CDCECF9B61B2FC85843BC99064D5A065AB4F6637FF70EA
                                                                                                                                                                                                                                SHA-512:C086C103EBEDFD9C888DB87E07D23340819D843DFDE422E92E22E651CFD865BF43763F97B671BA2DFE6B874C5BEAEE926C64BA9802037030B188809A0B0F7BB4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..."........e.T.e.T.F..........E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\12676 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):133
                                                                                                                                                                                                                                Entropy (8bit):5.05234209780728
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:rlShasEtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:ghSiclpJWw9LYX24Ztn
                                                                                                                                                                                                                                MD5:B258602D9107648235FD1900896F24E0
                                                                                                                                                                                                                                SHA1:DB756505CB4CB88B8B478AB30C97968EDF754AA2
                                                                                                                                                                                                                                SHA-256:5C596A86FF0036283BAC933793D204BA276B042EF765393D1DA5164421A373A7
                                                                                                                                                                                                                                SHA-512:402ACE41B1535FDAA90CF60F7BF0A601263698AC7EFAD0907CA9EA7303F2AAFFAB795AD762E1714D437D7DFCF8AF41F9694772CEB3C415AC244BBDF374B39AFF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.^..........e.T.e.T.F..........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\12740 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):126
                                                                                                                                                                                                                                Entropy (8bit):5.045224166719028
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:8l/oEsl3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:8hgRiclp+OGb9LUxG0OKLtn
                                                                                                                                                                                                                                MD5:52FF15DF40F76093B6C21CB21ECD7661
                                                                                                                                                                                                                                SHA1:2AFB4AAFDEA259F0E5E1F09B16351BBEF385B8BD
                                                                                                                                                                                                                                SHA-256:35E2CD29EDA92E43D399F1A4EF86C2B15A7282447190D24B4A8D1B7E5B6DA84D
                                                                                                                                                                                                                                SHA-512:B05D0F02E65FBB044638DED16F14060BC25579E92AE7AF4D6CF77BEA4A080FDE281C20F92209B9EBE9B0E45DD85CE78634E9D27C36A374A6DB211604CC5A4909
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...6........e.T.e.T.F..........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\17963

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):188
                                                                                                                                                                                                                                Entropy (8bit):5.0170279999714
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:jqhtKE97l3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6TaxXA8AsO7WfmqA8AsO7H:jqhtf9ZRiclp+OGb9LUxG0OKlmeO7WfM
                                                                                                                                                                                                                                MD5:7845461A1AC7232291D536232F6DDF40
                                                                                                                                                                                                                                SHA1:CA4CD4A5C5D59644E1F54ECF7273575FCE7EB141
                                                                                                                                                                                                                                SHA-256:13F612B62841E1CA4D418D72C64539452991D89BE1DAC928659B7664411867CF
                                                                                                                                                                                                                                SHA-512:BBA2ED3AF00733896F437350455C0DC3CF29EA0DE0E81DB8A2D8333F663F992F6D42AD94AF6DD935BEB42267151A4D5CA4D57EC3194AF2289BEF090E7DFE96F8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.@.........e.TSe.TrF..........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.net-response-time-onstart.4692.net-response-time-onstop.32898.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\23633 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):133
                                                                                                                                                                                                                                Entropy (8bit):5.05234209780728
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:rlShasEtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:ghSiclpJWw9LYX24Ztn
                                                                                                                                                                                                                                MD5:B258602D9107648235FD1900896F24E0
                                                                                                                                                                                                                                SHA1:DB756505CB4CB88B8B478AB30C97968EDF754AA2
                                                                                                                                                                                                                                SHA-256:5C596A86FF0036283BAC933793D204BA276B042EF765393D1DA5164421A373A7
                                                                                                                                                                                                                                SHA-512:402ACE41B1535FDAA90CF60F7BF0A601263698AC7EFAD0907CA9EA7303F2AAFFAB795AD762E1714D437D7DFCF8AF41F9694772CEB3C415AC244BBDF374B39AFF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.^..........e.T.e.T.F..........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\29991 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):129
                                                                                                                                                                                                                                Entropy (8bit):5.009798892494808
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:w8HLaugWuBMqEcldnXDLwrRzJKVJ3uDLjOKf6T0tn:jLa48iclpDLwnw+TOKLtn
                                                                                                                                                                                                                                MD5:45787E4012892D0CA3C56D6F6669447A
                                                                                                                                                                                                                                SHA1:E1F0227CA909371E6E547FF35D8549BD677CD25D
                                                                                                                                                                                                                                SHA-256:14EEC3F1F2A4347D85CDCECF9B61B2FC85843BC99064D5A065AB4F6637FF70EA
                                                                                                                                                                                                                                SHA-512:C086C103EBEDFD9C888DB87E07D23340819D843DFDE422E92E22E651CFD865BF43763F97B671BA2DFE6B874C5BEAEE926C64BA9802037030B188809A0B0F7BB4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..."........e.T.e.T.F..........E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\7304 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):113
                                                                                                                                                                                                                                Entropy (8bit):4.852370652693495
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:+Mllm//Lqa7XNWbdUyGLk8rLtPQ0IIt:+nmcEbdOx2Kt
                                                                                                                                                                                                                                MD5:A96A2B9A8A90FAF072A7DEB071704ADA
                                                                                                                                                                                                                                SHA1:37B704A650B9845083164BFF9BFF18D3A71BF110
                                                                                                                                                                                                                                SHA-256:3052445F4131B120D384C53587679F9572F4D2B1EAEA3B40901CCB0D8E2E4439
                                                                                                                                                                                                                                SHA-512:D66D188CB7BB5E67E81F8B350983A2CC7E15F3EEE597930F348730B34FB379DD659B3696F88821648C439A9730619F1157A738BBE1CB912A9FD17619BAAE9AC3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.<.@........e.T.....F..........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\7417 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):129
                                                                                                                                                                                                                                Entropy (8bit):5.009798892494808
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:w8HLaugWuBMqEcldnXDLwrRzJKVJ3uDLjOKf6T0tn:jLa48iclpDLwnw+TOKLtn
                                                                                                                                                                                                                                MD5:45787E4012892D0CA3C56D6F6669447A
                                                                                                                                                                                                                                SHA1:E1F0227CA909371E6E547FF35D8549BD677CD25D
                                                                                                                                                                                                                                SHA-256:14EEC3F1F2A4347D85CDCECF9B61B2FC85843BC99064D5A065AB4F6637FF70EA
                                                                                                                                                                                                                                SHA-512:C086C103EBEDFD9C888DB87E07D23340819D843DFDE422E92E22E651CFD865BF43763F97B671BA2DFE6B874C5BEAEE926C64BA9802037030B188809A0B0F7BB4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..."........e.T.e.T.F..........E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\7923 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):133
                                                                                                                                                                                                                                Entropy (8bit):5.05234209780728
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:rlShasEtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:ghSiclpJWw9LYX24Ztn
                                                                                                                                                                                                                                MD5:B258602D9107648235FD1900896F24E0
                                                                                                                                                                                                                                SHA1:DB756505CB4CB88B8B478AB30C97968EDF754AA2
                                                                                                                                                                                                                                SHA-256:5C596A86FF0036283BAC933793D204BA276B042EF765393D1DA5164421A373A7
                                                                                                                                                                                                                                SHA-512:402ACE41B1535FDAA90CF60F7BF0A601263698AC7EFAD0907CA9EA7303F2AAFFAB795AD762E1714D437D7DFCF8AF41F9694772CEB3C415AC244BBDF374B39AFF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.^..........e.T.e.T.F..........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\1E3866B584D906DD8CB8840AB2070142E2DEA38A

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):113
                                                                                                                                                                                                                                Entropy (8bit):4.852370652693495
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:+Mllm//Lqa7XNWbdUyGLk8rLtPQ0IIt:+nmcEbdOx2Kt
                                                                                                                                                                                                                                MD5:A96A2B9A8A90FAF072A7DEB071704ADA
                                                                                                                                                                                                                                SHA1:37B704A650B9845083164BFF9BFF18D3A71BF110
                                                                                                                                                                                                                                SHA-256:3052445F4131B120D384C53587679F9572F4D2B1EAEA3B40901CCB0D8E2E4439
                                                                                                                                                                                                                                SHA-512:D66D188CB7BB5E67E81F8B350983A2CC7E15F3EEE597930F348730B34FB379DD659B3696F88821648C439A9730619F1157A738BBE1CB912A9FD17619BAAE9AC3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.<.@........e.T.....F..........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9646
                                                                                                                                                                                                                                Entropy (8bit):6.073022101605759
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:vOj2OfrK4nllhIngC2rAl7YNCW2P8ro15j75ywpskCGcdB9dBM:vA2OfrK4nlygCmAl7YNFU8rIVy8eDB/K
                                                                                                                                                                                                                                MD5:50041387FDEB2EDED5DD4B7607DA187D
                                                                                                                                                                                                                                SHA1:E9612878012A877BF974140DF51A99734563A7A9
                                                                                                                                                                                                                                SHA-256:97A2D948EF926C25DE7A6A850EED80F6EC120EA9725AF4096C51E0568AEE301C
                                                                                                                                                                                                                                SHA-512:C61E98D1C64E78F43C6335AEB5F0BC8A082601FE747512837DB7A42F1963B2CF70B8223C14D1693ECB55243DA4F33DF215325616F24210E2A76FC45AAB5A08D1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"permissions":{},"data":{"attachment":{"hash":"0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0","size":7581,"filename":"asrouter.ftl","location":"main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl","mimetype":"application/octet-stream"},"id":"cfr-v1-en-US","last_modified":1648230346554}}..\...........e.T.e.T.F...e.tj...q....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAgAAAAAAAAAAAAAAAAAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAVgMIIFXDCCBESgAwIBAgISA4CDfEAtP9hr7GwhG2gLwsdOMA0GCSqGSIb3DQEBCwUAMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJSMzAeFw0yMzA4MzAwNzM1NDVaFw0yMzExMjgwNzM1NDRaMCYxJDAiBgNVBAMTG3JlbW90ZS1zZXR0aW5ncy5tb3ppbGxhLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6QswD2WRmcjnKD6/IdrFIpzCXYrtK7CkPccrkP2OCuV5Xo/c2d/mbhTdnRs+T+pB1

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\4C863284CDA7F859EB300BED16DBCEF9517F1824

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:PGP symmetric key encrypted data -
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):102
                                                                                                                                                                                                                                Entropy (8bit):4.731851638205665
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:VOlmllFAwxoeKtb9vX3XDkySLUxGTKlVX8sX3u+llln:40jVxoNlXDOLUxGbsHHl/n
                                                                                                                                                                                                                                MD5:9E5AC721D219CC9682B8C7227402F500
                                                                                                                                                                                                                                SHA1:155FB632869280F3571AD05F882564B462A604F3
                                                                                                                                                                                                                                SHA-256:CC2DF7E5E315FC1466C3912400DC7F3ECC18CE23E7E4C50044F4FD578656025B
                                                                                                                                                                                                                                SHA-512:13206AA65E42701547FF604ABE4968575896A53621FA13939275CB78E3066AF034EC3A02853872CD2329FF59D16B1C3C412A19E17EBDBAE99F721EAC680D652E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:............e.T.e.TRF..........+....~predictor-origin,:https://www.youtube.com/.predictor::seen.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\58A756A796A86993036E1F0F79183245EE2ABF58

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:PEM certificate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12978
                                                                                                                                                                                                                                Entropy (8bit):6.0428624450985415
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:HR3u9fiGLm4pUY8FzfDbIdbHc/FfTaIdqHcx:UBi8mCUY8FzfDbqLcdba8qi
                                                                                                                                                                                                                                MD5:55EEEA3ABAC9FB1B94C1E633F1DE7ACB
                                                                                                                                                                                                                                SHA1:2C9A067448EFF18306F730BA4649C8B9FB25C08C
                                                                                                                                                                                                                                SHA-256:DCCC4B8F4C3DBA34046E466EEADF126371C48342D56E1299B5A8FE6D24BE4150
                                                                                                                                                                                                                                SHA-512:1718C3737012A19D17D4958BE6F71020627AE405A14BB288ED50C5CE2107702415280782081DFD0D38BBB93BCF76239BB8497F3255A64D1A1791A382806B1673
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:-----BEGIN CERTIFICATE-----.MIIDBTCCAougAwIBAgIIF4NGAGgAoGAwCgYIKoZIzj0EAwMwgaMxCzAJBgNVBAYT.AlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3pp.bGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTFFMEMGA1UEAww8Q29u.dGVudCBTaWduaW5nIEludGVybWVkaWF0ZS9lbWFpbEFkZHJlc3M9Zm94c2VjQG1v.emlsbGEuY29tMB4XDTIzMDgxMDE1NTQxMloXDTIzMTAyOTE1NTQxMlowgakxCzAJ.BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFp.biBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5D.bG91ZCBTZXJ2aWNlczE2MDQGA1UEAxMtcmVtb3RlLXNldHRpbmdzLmNvbnRlbnQt.c2lnbmF0dXJlLm1vemlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8.zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7Gffqygmqry.EGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEo4GD.MIGAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSME.GDAWgBSgHUoXT4zCKzVF8WPx2nBwp8744TA4BgNVHREEMTAvgi1yZW1vdGUtc2V0.dGluZ3MuY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwCgYIKoZIzj0EAwMD.aAAwZQIxAKnhW7gpmEDAerMLSrR9kyCc82//G8dmfBsMJJxS6HNtZJi79sTvtm

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\6246CB7FA0A72939616FB877FF3FE3BF71EBC1BB

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):133
                                                                                                                                                                                                                                Entropy (8bit):5.05234209780728
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:rlShasEtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:ghSiclpJWw9LYX24Ztn
                                                                                                                                                                                                                                MD5:B258602D9107648235FD1900896F24E0
                                                                                                                                                                                                                                SHA1:DB756505CB4CB88B8B478AB30C97968EDF754AA2
                                                                                                                                                                                                                                SHA-256:5C596A86FF0036283BAC933793D204BA276B042EF765393D1DA5164421A373A7
                                                                                                                                                                                                                                SHA-512:402ACE41B1535FDAA90CF60F7BF0A601263698AC7EFAD0907CA9EA7303F2AAFFAB795AD762E1714D437D7DFCF8AF41F9694772CEB3C415AC244BBDF374B39AFF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.^..........e.T.e.T.F..........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\69455E9F6ABEDFC78866EDEA94CB9D51C573A013

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):126
                                                                                                                                                                                                                                Entropy (8bit):5.045224166719028
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:8l/oEsl3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:8hgRiclp+OGb9LUxG0OKLtn
                                                                                                                                                                                                                                MD5:52FF15DF40F76093B6C21CB21ECD7661
                                                                                                                                                                                                                                SHA1:2AFB4AAFDEA259F0E5E1F09B16351BBEF385B8BD
                                                                                                                                                                                                                                SHA-256:35E2CD29EDA92E43D399F1A4EF86C2B15A7282447190D24B4A8D1B7E5B6DA84D
                                                                                                                                                                                                                                SHA-512:B05D0F02E65FBB044638DED16F14060BC25579E92AE7AF4D6CF77BEA4A080FDE281C20F92209B9EBE9B0E45DD85CE78634E9D27C36A374A6DB211604CC5A4909
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...6........e.T.e.T.F..........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:gzip compressed data, max speed, from Unix, original size modulo 2^32 3053715456
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):8816
                                                                                                                                                                                                                                Entropy (8bit):6.638719453726338
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:jRsyVdtUy5yb0VyUyrQub0VyUyrQSNbZovzcd9YrdduYrl:jRjrtUYygoHJgoHbAQ9ifuil
                                                                                                                                                                                                                                MD5:239366D5D07EC287748F2910052B9F60
                                                                                                                                                                                                                                SHA1:D57027046BAC1B35392FA5BB9825C685D6F870F0
                                                                                                                                                                                                                                SHA-256:4E17733A987289D8B270D121F2B7C15E7380F10B56E7D0B87A6C9CC9F80F60E0
                                                                                                                                                                                                                                SHA-512:0DF2EB20C099B16BB9CAF3A99234B2FEF57D91086423089FCCA4CBC5DB323F6E9F9E719714B657FF942FF2BCF0693AF54C8121986C809A7ABBDACDDA24FDD822
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..............J.........f.M#*...*........Z."6..;.v.n....&5.0g..93..?tJ..E.....unD....N..~.3..c.t.;U......^..k.=.(..w...u...w~Y.].....6.6E....$..-2.. .\...@C. .}. ... H\.."/.0.8I`.8p=.~I|.a..|......T....f4C%~.Ce.n...N.[F.h.....y.....N.iZ....\!...dN1...p...SO$..../$.4i..=.....=F~A...G.{.f.....PS|w..j)L.).u)$..F.x....-..`.0.>.+...K.m.,..../D.....t.WQ.%F.H..z...*c......,..1.3......&C..\.....J.HG-.mM....m<.fj^.b..[sBE.......%.xO...z2......#..wX'.D.pN_.....bHT~x..Y.i@...~.....z.k.{..w$F.ee1A.Z....<[....;..]...6.sf6...s....JM.6Q...X...0.=..6/k.........g..M..x...I......|#W.Ep 1.9.u.K..G>*.4...i..|7*z...[2}.c..%..<.z.F]..xc..*JQK.ns..."QO<g..._E..G..h{>.."..^*fP.(.X....B.gSkl..[)Z.GE.E.^?......_......2..5...]....;..=0.]0T...O.....w..._.....Q...3.....1{...n.......t.....kTQ...A..5V...|....w9w.o.>.{.5W(.....w......Y.~#..50.Ni.. 86..F.~[d...z..J0..n....L....\.r...:..y?f1.1..',..X..M/U..ue...sK'.;.|...S.{..o..6.H.S...I....8.......|9n4\c.<...=x.h....R..y..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\79B11E5B2A73707AF920FBB504E5C456E1698B13

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):129
                                                                                                                                                                                                                                Entropy (8bit):5.009798892494808
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:w8HLaugWuBMqEcldnXDLwrRzJKVJ3uDLjOKf6T0tn:jLa48iclpDLwnw+TOKLtn
                                                                                                                                                                                                                                MD5:45787E4012892D0CA3C56D6F6669447A
                                                                                                                                                                                                                                SHA1:E1F0227CA909371E6E547FF35D8549BD677CD25D
                                                                                                                                                                                                                                SHA-256:14EEC3F1F2A4347D85CDCECF9B61B2FC85843BC99064D5A065AB4F6637FF70EA
                                                                                                                                                                                                                                SHA-512:C086C103EBEDFD9C888DB87E07D23340819D843DFDE422E92E22E651CFD865BF43763F97B671BA2DFE6B874C5BEAEE926C64BA9802037030B188809A0B0F7BB4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..."........e.T.e.T.F..........E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.necko:classified.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\7FEF50EB1C89E58D7202896295BED2C7C56D1C99

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):454009
                                                                                                                                                                                                                                Entropy (8bit):7.9977605302725445
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZeT:tEsed2Xh9/bdzZeT
                                                                                                                                                                                                                                MD5:89988ED59DF550794A23F28E79A4B690
                                                                                                                                                                                                                                SHA1:A1C4EF116315C742F4595F7E624ACC3DF8AA92B0
                                                                                                                                                                                                                                SHA-256:690AF0E4C828FAE26ADA34667414E01FA82C9592B81B3B781BA5BA94A502F9F4
                                                                                                                                                                                                                                SHA-512:02C21EE362D3171CF75F91C40C2058B8E57ED0D49A338ECEA0388F9C8EBA6E0D4909044EBA86476FEAAAFB52EAAD92D7772431CBEE51542E10B731A96AEF0919
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\97AE667565B6120DDEBF42730CC21468FE5AC36E

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):103
                                                                                                                                                                                                                                Entropy (8bit):4.730441067596769
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:4DVJerlljXvX3XDkySLYXqhJX8sX3u+llln:UVJiLXDOLYX2qsHHl/n
                                                                                                                                                                                                                                MD5:9866C2B2F52E3E447DFFC6BFE3B637DC
                                                                                                                                                                                                                                SHA1:F3B4909C8A5FDE7C41AC0B707250F1DD849412BD
                                                                                                                                                                                                                                SHA-256:7F1B109988F754312195C1199E75494EF9C65E612829A08E7EE49B41335B03A5
                                                                                                                                                                                                                                SHA-512:C95E2102DDDAFE29988DC018D61910C1238968B3A0FE76A942A5CF764AB6F6B50B6C01F9022DFE4B0B9EF7E09424B1FCE4ED68B79F7460843D073DCC0F01D40D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.;`........e.T.e.TSF..........,....~predictor-origin,:https://www.facebook.com/.predictor::seen.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\C886C15B36E63849FB9E86DCC97456303F590459

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106
                                                                                                                                                                                                                                Entropy (8bit):4.637448735331897
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:ulAVJe+lljXvX3XDkDKVJ3uDVX8sX3u+llln:uuVJnjXDkw+qsHHl/n
                                                                                                                                                                                                                                MD5:0561E37BC033FFF1C00C10C2E8F67F5C
                                                                                                                                                                                                                                SHA1:F14CB3F033FB173E9EE6E652C59CA2004D704BC1
                                                                                                                                                                                                                                SHA-256:9C11857F0AC4DF38834A0C68BC2DD0141F77FA5F4FA3DD1C82EAA6D3EA5C3C25
                                                                                                                                                                                                                                SHA-512:459C887978F1533954DB12DBE1360D34F9BD0DED19BB209DAA160E97697D1E8FB7E0DE1169FFE7572D6080B25B4424443E9BFC9224E90F8C6C5A2C67A4D554DB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...<........e.T.e.TSF........../....~predictor-origin,:https://accounts.google.com/.predictor::seen.1.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):35420
                                                                                                                                                                                                                                Entropy (8bit):5.085932193972411
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:uPtFYceo3KtwnY9nR+eXHxoZ/HJkNTBdHOT5Qhh7veKyt9KZn:seo3KtwnY9nR+eXHcHJk/dHOTij75Bn
                                                                                                                                                                                                                                MD5:9ABD1F19141EABD2D6C60829D6049802
                                                                                                                                                                                                                                SHA1:B77144286A8162CE9D2000BE400C40AE7D889A91
                                                                                                                                                                                                                                SHA-256:7112D89BBDF8AEAEED70F64F78BE5CADFEDDD7D923590E6912D58BDFF326239D
                                                                                                                                                                                                                                SHA-512:170B5A09BD11F04B68103FE3E4FEE6C51CF065FC50E9C20E581D7EA13D35DFAC44B34C0B5EA412655C7E33217B21ADACC0EF789CB8E857419A164AA713E82183
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob: chrome:; style-src 'unsafe-inline';">. <meta name="color-scheme" content="light dark">. <title data-l10n-id="newtab-page-title"></title>. <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>. <link rel="localization" href="branding/brand.ftl" />. <link rel="localization" href="toolkit/branding/brandings.ftl" />. <link rel="localization" href="browser/newtab/newtab.ftl" />. <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />. <link rel="stylesheet" href="chrome://activity-stream/content/css/activity-stream.css" />. </head>. Cached: Wed, 21 Feb 2024 01:40:39 GMT -->. <body class="activity-stream">. <div id="header-asrouter-container" role="presentation"></div>. <div id="r

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache\scriptCache-child-new.bin

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2029892
                                                                                                                                                                                                                                Entropy (8bit):4.701156726468159
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:+6j+d487l/bpQoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ib+M5TkRYX:AdR7l/bLs6BjUNRYRck
                                                                                                                                                                                                                                MD5:04F00B709D92A4DC8BF6CDDE6AC3BFAF
                                                                                                                                                                                                                                SHA1:E8F46721CB9E33A40C55CFA52B08371722FEAA63
                                                                                                                                                                                                                                SHA-256:62E09ED0E9A8136BF7FDD439BE0CC326C5FD84AA511CCE50C0D4DBB68BA37E06
                                                                                                                                                                                                                                SHA-512:9DE3CF0A0C752AA529A7F38E2B7FB2070B502925D9017C103C32BD117089F347E20996E2FB3B118EB1219746AACB3F4ACB66FB187B44937331EF3D881F75BB69
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozXDRcachev003......I..9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache\scriptCache-child.bin (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2029892
                                                                                                                                                                                                                                Entropy (8bit):4.701156726468159
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:+6j+d487l/bpQoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ib+M5TkRYX:AdR7l/bLs6BjUNRYRck
                                                                                                                                                                                                                                MD5:04F00B709D92A4DC8BF6CDDE6AC3BFAF
                                                                                                                                                                                                                                SHA1:E8F46721CB9E33A40C55CFA52B08371722FEAA63
                                                                                                                                                                                                                                SHA-256:62E09ED0E9A8136BF7FDD439BE0CC326C5FD84AA511CCE50C0D4DBB68BA37E06
                                                                                                                                                                                                                                SHA-512:9DE3CF0A0C752AA529A7F38E2B7FB2070B502925D9017C103C32BD117089F347E20996E2FB3B118EB1219746AACB3F4ACB66FB187B44937331EF3D881F75BB69
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozXDRcachev003......I..9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache\scriptCache-new.bin

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9073328
                                                                                                                                                                                                                                Entropy (8bit):4.7345855876723
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:9vBwPDxG4C4sWDc+ikpXGBmBDkG0CpKRAuAgdyR+FpG1Kl/S/qya+N7h//uTl+EL:9vsEW5IBmqaVgdyGn/SSyaw/Y+EKm
                                                                                                                                                                                                                                MD5:0B47B3858CEBB026BC7D13BE2C151480
                                                                                                                                                                                                                                SHA1:F4A2B9AEC015FB418A85B1E2509BD2BEDA514F9D
                                                                                                                                                                                                                                SHA-256:5CD9792822098AFF9A891AD14CBB6FE4981E1D1B6467C189AEB6D6B48D69D4F0
                                                                                                                                                                                                                                SHA-512:7F6489909186241589F94210D7A48A2820BE32A679546DB1997D20D657EA9ECEEC7167C1223A69B51C639D4026BE7F8EFA629EF01119BAFEC344BE9EDE8BB452
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozXDRcachev003.....\.3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5.....resource://gre/modules/nsAsyncShutdown.sys.mjsJ.jsloader/non-syntactic/module/resource/gre/modules/nsAsyncShutdown.sys.mjs.m...,...,.resource://gre/modules/AsyncShutdown.sys.mjsH.jsloader/non-syntactic/module/resource/gre/modules/AsyncShutdown.sys.mjs.........2.resource://gre/modules/TelemetryTimestamps

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache\scriptCache.bin (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):9073328
                                                                                                                                                                                                                                Entropy (8bit):4.7345855876723
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:9vBwPDxG4C4sWDc+ikpXGBmBDkG0CpKRAuAgdyR+FpG1Kl/S/qya+N7h//uTl+EL:9vsEW5IBmqaVgdyGn/SSyaw/Y+EKm
                                                                                                                                                                                                                                MD5:0B47B3858CEBB026BC7D13BE2C151480
                                                                                                                                                                                                                                SHA1:F4A2B9AEC015FB418A85B1E2509BD2BEDA514F9D
                                                                                                                                                                                                                                SHA-256:5CD9792822098AFF9A891AD14CBB6FE4981E1D1B6467C189AEB6D6B48D69D4F0
                                                                                                                                                                                                                                SHA-512:7F6489909186241589F94210D7A48A2820BE32A679546DB1997D20D657EA9ECEEC7167C1223A69B51C639D4026BE7F8EFA629EF01119BAFEC344BE9EDE8BB452
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozXDRcachev003.....\.3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5.....resource://gre/modules/nsAsyncShutdown.sys.mjsJ.jsloader/non-syntactic/module/resource/gre/modules/nsAsyncShutdown.sys.mjs.m...,...,.resource://gre/modules/AsyncShutdown.sys.mjsH.jsloader/non-syntactic/module/resource/gre/modules/AsyncShutdown.sys.mjs.........2.resource://gre/modules/TelemetryTimestamps

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache\urlCache-new.bin

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2850
                                                                                                                                                                                                                                Entropy (8bit):4.810270777479369
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:KwFGeU3deLVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNm7J:KmLU3Wu38qgbkgbIKKRCUOt9Jrq
                                                                                                                                                                                                                                MD5:B22F832FFBAB40FE8021D004E37E5660
                                                                                                                                                                                                                                SHA1:DD8E34685558A4A7EA8236DF2E846AC1BD82975D
                                                                                                                                                                                                                                SHA-256:8B45AFF49514E309802F97AB37134775F7229EB8FFC76F3EFD02E32C9E02397A
                                                                                                                                                                                                                                SHA-512:81F3E61CB5ACAF9558BBCDB95FEBD957DDF3D4FB26CA810FECF3A6FC73A724925F6CCD87D91015E8A0F453B04463F07CB5FEEBAFAF907A7DFFF06E2D1C0C4AB3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozURLcachev003.......;x._.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.g.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ftl.1.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache\urlCache.bin (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2850
                                                                                                                                                                                                                                Entropy (8bit):4.810270777479369
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:KwFGeU3deLVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNm7J:KmLU3Wu38qgbkgbIKKRCUOt9Jrq
                                                                                                                                                                                                                                MD5:B22F832FFBAB40FE8021D004E37E5660
                                                                                                                                                                                                                                SHA1:DD8E34685558A4A7EA8236DF2E846AC1BD82975D
                                                                                                                                                                                                                                SHA-256:8B45AFF49514E309802F97AB37134775F7229EB8FFC76F3EFD02E32C9E02397A
                                                                                                                                                                                                                                SHA-512:81F3E61CB5ACAF9558BBCDB95FEBD957DDF3D4FB26CA810FECF3A6FC73A724925F6CCD87D91015E8A0F453B04463F07CB5FEEBAFAF907A7DFFF06E2D1C0C4AB3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozURLcachev003.......;x._.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.g.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ftl.1.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2332672
                                                                                                                                                                                                                                Entropy (8bit):7.9618356942587125
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:eHex9yDOkBt8Oi0WWY6KtnHvjQ2SUueEMpZ0Q7zax8UFQdhoOIEgXlLv:egbkB18jQ2fueEA0Q7zait3IEmv
                                                                                                                                                                                                                                MD5:9565A774CCE1318D00AAD201D54179AD
                                                                                                                                                                                                                                SHA1:9369239B7C872D3CC46E55178EEDA3CC6652E2E3
                                                                                                                                                                                                                                SHA-256:9911129661BCE9C536C1232B12B2AA19501D9DFAE099C146D25308C7BB6839AC
                                                                                                                                                                                                                                SHA-512:4EBE7B64B0EE4EBDD1EF355D3B0B5F4CFF22C83AC47E1FE317634CE3D8BA99494C5FA2790D541797C3DC52F4A71230361DC80BC2DFB4675F7F1196D89F1B0E3A
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L...N@.e...............".....L........Y...........@...........................Z.....U]$...@.................................T...h....p..h1.......................................................................................................... . .`..........................@....rsrc...h1...p......................@....idata ............................@... ..+.........................@...nlyzwaah.`...p?..V..................@...lkbejoib......Y......r#.............@....taggant.0....Y.."...v#.............@...........................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):26
                                                                                                                                                                                                                                Entropy (8bit):3.95006375643621
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                                                MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                                                SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                                                SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                                                SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\027b60cf-3970-4abe-a483-95a87660f740.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 744217
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):342537
                                                                                                                                                                                                                                Entropy (8bit):7.997975476735479
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:6144:5MK44qtYeM1pSD7Nf3ckCsaCbzHywGzvXzTm2q5oSkxVVUy+PITOKE:6KRq6v1oD75skC0zHyrf/q5oSQVuQT8
                                                                                                                                                                                                                                MD5:CC2DA86C7F450F32F2EB5F4F57ECE31C
                                                                                                                                                                                                                                SHA1:0FCC81CC12D7589D431602D8AA4C962A22876AA8
                                                                                                                                                                                                                                SHA-256:17FFD732A05980AB545B7363C9047D1922EC51D7D6B0BF21B80729CFA468ECC7
                                                                                                                                                                                                                                SHA-512:DD28E4A84682B304F0AD7B22347FF9A8D8F646BACED20EF12BADDDD24FF50A6AC077DD30F102AED1F77ED5F43CA2C003BC4B70A86BD52723C027D942B82B118F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...........ks.6.(...O.6.U......T{j.;v..I..n.T>.1z.zE#.U>..6... ......T.4C......Fc...'rB..{.O..9.&....l...}GN.|.g.{...>........y........".yH..w..yK.I......_[......wK........#.{..>.;r...3.{.-..j:...s..O..!9..v...xs.....'._.y...@_..'....:.VG.....?..... ^t.=....=.1.....:........W.2.im..F.......+.o.....B.....y.?:.V.Qfh.k.f.~....w..w...Wxz!..1......l...m.4...P.t.......=h.A{..{......_..>.........S|6E,.hj...=......9[~b.+........;...[=/6..qE...4.'$....B._..G......}.O....%yB..1.....XM.......C...k.......[....0.O.i.}.=.].eL..........hd..}.m.w..vq.1..QO.F.O.8F....4*q|.>] ............;.l...I.'...:D8?.3....P..H.6...\ .#..(=..{.N.....y.oU.....`..Jy.l...1z.:...)..S...<...Gr.m...iBC.............y.4B.......j..AJU-u.p.5......9.F......b..R..I.....&.P..<#..g...jas...1..!....8.K.o.....'.O..h....S..v..3.=.9....[..a8=&.....w......3yE.A/j)..V.f....S.2.7..)......7..).....T.P.~..m.._"..[.&...J....:&.D.){3Y......mCz..w.m...|K.|.............F...Kwaok..[..0..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\0665ba25-859d-4a58-ab3a-52c9ae90a183.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 52603
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):112595
                                                                                                                                                                                                                                Entropy (8bit):7.996596948494687
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:3072:n9VHTXgKltALhzrVO8JFAWurVO8JFAWG1HanHjz:n9VH9QoSTEoSTYH4jz
                                                                                                                                                                                                                                MD5:FC658AFE962C91E867FD5F9A3AB43365
                                                                                                                                                                                                                                SHA1:9E6B7330A00186A742513AD030332037E217C0E9
                                                                                                                                                                                                                                SHA-256:3BDD151795EECC19FBCABCDE0B777DF151FDAB297C885BBCBEB47CEED7130CBA
                                                                                                                                                                                                                                SHA-512:DC83A4CE6D8ACAF03127426089FAA21D89BFE810DC444231CCEDB258F1D4A8E2A1A2E578D957DAA45F07129FFCE8475FEF0F35F89434007C5F061B66C872C52C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...........}kw.H..w~.h.9.....fw$gq\.{.f.]u....3u.$.c!......7".).......4.R....WFF...j....!.M.y.M..c....$...S?M.:...g.*....%~..q....:..O...2........g.."...t.6f..'..k...>...."..W1.0[..3h6..2...z../.Y..q}3...^G.V....kY.....Pd.oc=k=...<_z.....v...8aYV.?.:....hCg!.i..p.w.Y...=.%t%.F..$...Y=.d1|....M6.g.....|.dq...Vy6..s.J.S0Z=..)H...U..U.pz......t......N.~=...tqU...~..........S...?...ty..c....o.....8C..Q`]...ui....x.....:.....>.R.O}.g....q...j.d6..AN.J...q....K..K.....k.x....v...W.w.....W...{.I..o!;"A.[.F.q.<........E.b..4.x.,.3..<.r.Q&.H.'Ek.".,..Q..~..X.).].f.y....`. !V2K. 3S... .^.h.#..|.....lu....Rd[... ....4..t..W.k..kw..o...a._d.".K..|..p"..&...<....6..jzj/...&....~.o.M....8Z.S.=.H.X.:_....|.gV...<...n7[]....../....!.f..._...$.?o./..0%......rv...`.....<..6k.Aj...!K.....)|..,.1.....~.|.kX..`.[8B,.l.{............L.R&.5X.....6...<Mgs....j....1j.S.c..k...x....,e.T3......Qg.w<m..>.S5...t.T.].=.^..~.....z.)...S<9.u.=Y....x.5.].'..3.........}.C

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\457347c5-ca93-486b-8012-d538ba7daad6.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):652784
                                                                                                                                                                                                                                Entropy (8bit):7.9720029039139835
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:0fCmlkFft+cGSYH90FBI2tVgoFnC3Jlqeji+dJA1bw9TxyB1SxE4+Bd:0KmGFfA+YHeFK2TlQ3zqv0JJ1Y6W4+Bd
                                                                                                                                                                                                                                MD5:FCC7F736C39980BC91C5829F35691EDC
                                                                                                                                                                                                                                SHA1:2A069C34CE12AD43865C0D5ABC9720AA1A431991
                                                                                                                                                                                                                                SHA-256:D79639FA4F25B50671482A3E08D836BA577830030DD3F699E5F8CB987AEE5069
                                                                                                                                                                                                                                SHA-512:51675666597BA61C4E3E20277CF34D45408E6E30EFE49B46447E578A36A14B0B957AC3D407B6F22637A80D61525D743A628F3C41AC480931A5FEC9F064F050B5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e701000091020000d60200002803000006040000e104000018050000560500009a050000ee060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................W...yO>&..-.?.y.K.I.....WA...4...41J..`.>.~.p..mX.6.)6..qr....e2.o..."..........................!"4.............`..j..pVL..%.A/.. .Jk..UO.........1...h.\...BNc..n..B.1Z.{.v.8.HT....C...R..4b-..sS...r....0P..`...[.$ i.d~.a}.G...^2.....?............................1A.!........?.s.H....D.v1l.M.".5.x.8EO.............................1AQa........?.Y...V.4.uZu..2./..=._...1......................!..2AQa"1q..R..#4Bst.............?.,x.i......*.[I..I./p'>sA....J...I..i.6K.#.V.-.Av.+/%.\..e...OG(L<4.h.M..5.......}. ...G>......^...'..+.....8.7N..52.By.9 .A...$..O...7.6.S.q&.s&ew|.fSF.......S:!..G......%.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\59e2edd4-b030-4bbc-bdc2-4893fc64b9bc.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 39877
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):63573
                                                                                                                                                                                                                                Entropy (8bit):7.995550055904634
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:1536:JJ93b5HjtFbXSfvebllLerLhbVyqJEZGw:n9VHTXgKltALhbVBJqGw
                                                                                                                                                                                                                                MD5:34ED4BE01F18E2FE3EE18D7B1B28808B
                                                                                                                                                                                                                                SHA1:FAD95EAE67FD2F56546E97895557A7F4C9A87797
                                                                                                                                                                                                                                SHA-256:77D996E2A71B679E722B0FE30699A2E5CF3EA75D0C67095804D5613EAAE1BBFE
                                                                                                                                                                                                                                SHA-512:117A3269D6C9A2E02E05361CEFFCDD44D25B3C99AFDCB32B4B76281BF3C0F51CE7CF809FFFE627143F00EF2135AA8E8D7887FA97B67E286F82CCAE4D82CD864E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...........}kw.H..w~.h.9.....fw$gq\.{.f.]u....3u.$.c!......7".).......4.R....WFF...j....!.M.y.M..c....$...S?M.:...g.*....%~..q....:..O...2........g.."...t.6f..'..k...>...."..W1.0[..3h6..2...z../.Y..q}3...^G.V....kY.....Pd.oc=k=...<_z.....v...8aYV.?.:....hCg!.i..p.w.Y...=.%t%.F..$...Y=.d1|....M6.g.....|.dq...Vy6..s.J.S0Z=..)H...U..U.pz......t......N.~=...tqU...~..........S...?...ty..c....o.....8C..Q`]...ui....x.....:.....>.R.O}.g....q...j.d6..AN.J...q....K..K.....k.x....v...W.w.....W...{.I..o!;"A.[.F.q.<........E.b..4.x.,.3..<.r.Q&.H.'Ek.".,..Q..~..X.).].f.y....`. !V2K. 3S... .^.h.#..|.....lu....Rd[... ....4..t..W.k..kw..o...a._d.".K..|..p"..&...<....6..jzj/...&....~.o.M....8Z.S.=.H.X.:_....|.gV...<...n7[]....../....!.f..._...$.?o./..0%......rv...`.....<..6k.Aj...!K.....)|..,.1.....~.|.kX..`.[8B,.l.{............L.R&.5X.....6...<Mgs....j....1j.S.c..k...x....,e.T3......Qg.w<m..>.S5...t.T.].=.^..~.....z.)...S<9.u.=Y....x.5.].'..3.........}.C

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7VjcYwCMF_u_3bGwi0Uji59.zip

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3294
                                                                                                                                                                                                                                Entropy (8bit):7.7879389198565745
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:38DeaDgsdKAYvJ0gjBQhF5mpbGusC3KJd:38DJDgsdKAYvJhY8pCusC6Jd
                                                                                                                                                                                                                                MD5:0C28A5CB89340507AB52780B60EAA5D1
                                                                                                                                                                                                                                SHA1:252D9F9A9491FC325D59ED7B4028C89C4F54839E
                                                                                                                                                                                                                                SHA-256:DBBFE88F57210A8E5D42E59A032ADA7C354869AC7628C65B767259994C5748E5
                                                                                                                                                                                                                                SHA-512:FBF4A46A333D4054F7D7604E2ECA00C078E473825E544EB94F0E49E5EEC1370AA5AD749B8369CE7D3975B297905DFB8D3CF6752B744991C078E736849BE2BC5E
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\7VjcYwCMF_u_3bGwi0Uji59.zip, Author: Joe Security
                                                                                                                                                                                                                                Preview:PK..........UX................Cookies\..PK..........UX..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!*.......y.o;.F..5%.....|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK..........UX=#G.b...'.......information.txtuY[o.J.~G.?../3:...j..M..$3.9lH&.MV#c7..c#..2...[vC.\..H.._Uw..m.%#.sUl.~.-...G..u...}.j;bw6a....<1..H.LxB.&Q.Js{.a.B...p..&.(_x.y...Zz.....x...md..I..Ry...h.... .. ..5....._.wy.H{I.../...H.b..7..0.D..Q..9....G..X......&..%......~.(...l.o+..!..E^=.m6..E.e.7v.y..bn..K....~R.Sc.j....04C!|...^..nSw;...i.....8._.d.'.s..t....x.._..O.7..mmK.g..tk#.........z..&.^...l..q.x/......(_n.%,..`|..}..."*..'...|........*.%.I.~..8......qJ.?.......^...E..oo..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\7ff7fa8b-4c51-4dce-ae0d-688060f9e719.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):621650
                                                                                                                                                                                                                                Entropy (8bit):7.969425298588942
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:hfCmIx5tC4goFnC6i+dJo90FBI2tXJlqeXB1SxE4+BIYNcGm1bw9Txt:hKmIx5tlQr0JoeFK2JzqG6W4+BIYNT13
                                                                                                                                                                                                                                MD5:A40797B847848F438E6F6BBF166C0113
                                                                                                                                                                                                                                SHA1:4B4ED6915789DA310D0E0D3BDABCAAB73E76E1BD
                                                                                                                                                                                                                                SHA-256:8D57A9021D0EA11512C1095E85BC30E9EEFB4D9923ACD6C71D1C8F688FCD62CC
                                                                                                                                                                                                                                SHA-512:AC5F4C026471BC3F2D4087AFFE3DBCE96FFBD61CDE6FB530B5577C3DB7394FFE074A2E0867C72E6C6168455212D2868AFEA625AFC8D422574B0161E2F70AB16D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e701000091020000d60200002803000006040000e104000018050000560500009a050000ee060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................W...yO>&..-.?.y.K.I.....WA...4...41J..`.>.~.p..mX.6.)6..qr....e2.o..."..........................!"4.............`..j..pVL..%.A/.. .Jk..UO.........1...h.\...BNc..n..B.1Z.{.v.8.HT....C...R..4b-..sS...r....0P..`...[.$ i.d~.a}.G...^2.....?............................1A.!........?.s.H....D.v1l.M.".5.x.8EO.............................1AQa........?.Y...V.4.uZu..2./..=._...1......................!..2AQa"1q..R..#4Bst.............?.,x.i......*.[I..I./p'>sA....J...I..i.6K.#.V.-.Av.+/%.\..e...OG(L<4.h.M..5.......}. ...G>......^...'..+.....8.7N..52.By.9 .A...$..O...7.6.S.q&.s&ew|.fSF.......S:!..G......%.....

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\80360f2a-4107-40ae-be19-96c664a79401.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):211725
                                                                                                                                                                                                                                Entropy (8bit):7.984421368430842
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIN:l81Lel7E6lEMVo/S01fDpWmEgz
                                                                                                                                                                                                                                MD5:A4144BE278CB1656AC49920A15B03D1E
                                                                                                                                                                                                                                SHA1:CE1C98753AA8A954A510A4C3DD00E6224CA11CC6
                                                                                                                                                                                                                                SHA-256:CFCF65506CCC3F49FD29FCA61B6D9EAEAE9B7DB2B3B3823A5E8439AAF8C43E07
                                                                                                                                                                                                                                SHA-512:12F58AF91F953DEA0DCCCDFD6B065D18B19FA5988BA6B4125E7ECEEE930C40810991A7F527D42E61F479A8A7E4AF6E5AD1A0415659BE89C60891DD2890E9F268
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\Ci0SBvvC_ABy4cFBW3g7apa.zip

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4365
                                                                                                                                                                                                                                Entropy (8bit):7.846020301525012
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:vSu9CWkvIMewiYYoFNcmo0DveHssJlwRLG6r/kHdUiyOHk3KJI:v9CWkgMewI0DvdsoLG6jwzHk6JI
                                                                                                                                                                                                                                MD5:D08314C6156FDFBAD18EA8219A3FC1B5
                                                                                                                                                                                                                                SHA1:FD1BE3B6773E55FE64E48597A03A09F440AC58A9
                                                                                                                                                                                                                                SHA-256:81B5CDE2C6790A8EEAF97CC5CC24F678CD376542FA8D7655F23710AC316D03E6
                                                                                                                                                                                                                                SHA-512:EBCD3C054F99F9312FC7848FDD9B3944FF2334017926403F38A61E328C1ECC62D5B333FAEA4FFC1B5BA1DF256FE68B32D99EF1F1C38463178F2D9D0E0A031EE8
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\Ci0SBvvC_ABy4cFBW3g7apa.zip, Author: Joe Security
                                                                                                                                                                                                                                Preview:PK........\.UX................Cookies\..PK........\.UX..p.R...n.......Cookies\Chrome_Default.txt....h.F.9.H.I..E-~l`..<lR.x......#.(K5-U.z..q..wy..>o...o.......<P..0.AP.M..7A....GR.....v..>,Q*.Jd.'x.z...k...~.d=...rr)|.-.{d3...7...:.o..S..3........5.r../H.@...0L...-eU..@. ..?.x.@D./...(.q..%B.e..|.f.K..g7..>..a.G.,5j......-.IyW...."..8PQ...<P...;..e.ta.n..........D"s.....:...........%Y...i.&4./..JdR...~..?.~y-..9G..Aq.x.L...Qm5D.-.n..6O\.......1....S...<.m.M..iRv...@..G...E..Ba.E".g..7..l[6..E.>&..a9...)..K..5x".....{3.K..!.v.).>.^...R.X.=Pe.P'F 8J~..d[v..C.E...dO...)...z......z...[.Q.r>[.n..5<..4~a.....4-..\.q.....|.%L.....9..g!b;biZm..eC.......D.....^.4.e.a%K[.X.u.?.Ghs_h.O....8E.v.{l..w....AB0[G.-..]u.........8..5...[F..~!i.......I.~ec..(.JX...5nd..."LX.w|...z..g.NA...uZJ....B.ih.]...F..B.WE.n.\....R..u...C~....M.@>..s...../.-.k...,.."#..i..M0.4.8.......DC.$...u.."..../...H........J.D'..../.4....?..~E...9....V..N_.w.s8C..(._r.,W

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\EdgeMS131\EdgeMS131.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\NsDq1AXD5Zu7PIsqGltDvI0.zip

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2569
                                                                                                                                                                                                                                Entropy (8bit):7.847548853759824
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:97JNNhJXwvRayF+GbbUTa0//EBvBH636KKeg/vU8yBJRWn3KJ6yyw:lDNryF9bkH/e46KKHsj43KJ1
                                                                                                                                                                                                                                MD5:B1DED140236C28A4CB030BC9E9FD4F93
                                                                                                                                                                                                                                SHA1:95440A8C7CC4C7D8E2FEBCFF5F9402568BD96143
                                                                                                                                                                                                                                SHA-256:D4EE48E746E9FE40E65CD5101B718BA7275C93D01D046EB14813315E89932162
                                                                                                                                                                                                                                SHA-512:D9B28D69A456D828B58ACAE717DB744655B6DD6043CFF315774B739DE1B0F744A07437FE70E4AC4A6A6D7B3D3315D7A46545A43C11BE50CBF85E7C99B9B800D5
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\NsDq1AXD5Zu7PIsqGltDvI0.zip, Author: Joe Security
                                                                                                                                                                                                                                Preview:PK..........UX70E.............information.txt.Y[o.J.~G.?../3:..w.<m..$..f....&.....bl.6..j....!...*B......U.%..,O..m^..n..TuV.......v....{..?.pF(..h ..)..Q...\~...0.'&.%..{2.7I.IO...$.&)....m+..X.$...4K..c......j......o.sq.J.4V.&Se..S>.pA'Q...S...Wq3.........|Z....r.....$.....]1.>....t;.e.D.f..Spc...8-'....h..ut:..._^A.".t...>..i.46......j..f.+,..i.RCh...(..J..._..\,W...x..W.s.v;.m.......e...kS....xH....1.=.f+.z@L..^t;.....}.l9+fyV..."k ..b.......!.fNn..(../-1.%.N;.....!kc.p....?....u...,.....L.ee>.>s2..%ZSJ.Fx_Rr~....pX..f@......z2:..f.)..W...2....iCN.:K.6.'i...Z[6.......Y..6..f..M.J.".?.E].\!.B.......S.^.......}.E....YYl0.hH.s..8L[.y.o'j.*...yYo......7i.......C.a......./.....Rz..O......b.*.c..1.`.G.#k..Y.D.c...Hd..o#.(..m}V..(7.R.Z.|.....w......oz.a~.X...Q...,..y.E.>..HZ8...........r...9.B...,y.).W.v.O...b.}C.b.B......-..,.9*.#D.....!.e..P>.....-......H..W..%.z.CG..e..@Z}i\_|...+..<.&...)Vg.2S$fg....6.q.V..ve....Z..M\%s...mC...F7....*8..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\a65cd3a8-0a1c-433f-b7c3-3acf37683e03.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):11185
                                                                                                                                                                                                                                Entropy (8bit):7.951995436832936
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                                                                                MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                                                                                SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                                                                                SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                                                                                SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobe24o_MSNyMBSg\information.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6903
                                                                                                                                                                                                                                Entropy (8bit):5.2828023458037086
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:x0+lkbRMVLc2KBhA6tsxODsbunwuGxyxBFUDBDaPZcAu6dsetIQpRypT4VBEwrwL:xfIeVLX6tsxPbtCGGIB
                                                                                                                                                                                                                                MD5:E7E92ECEA75925A4BAA7D8B105E10BEE
                                                                                                                                                                                                                                SHA1:627C363377323320FED071F89B5E08FB513698B9
                                                                                                                                                                                                                                SHA-256:148F08207CCC555DCA0B0D29887C30BB05A3D72BCA351C98F8B8D4EC8FEEE56A
                                                                                                                                                                                                                                SHA-512:33FDAF5A182BE600B564C39E081A38392601DFA3530C2932070C723DF0C8EC6C0ADC235174BDCEDC9C19521C1B3E89AD91DCCDFF6D7C4952C48AAD1087076E4C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Build: zhopa..Version: 1.5....Date: Wed Feb 21 02:39:37 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 0da550cf5e762d2fb230b9c9a02af5aa....Path: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobe24o_MSNyMBSg....IP: 191.96.227.222..Location: US, New York City..Windows: Windows 10 Pro [x64]..Computer Name: 562258..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 21/2/2024 2:39:37..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788]..svch

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobe24o_MSNyMBSg\passwords.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4897
                                                                                                                                                                                                                                Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeP9l4P_8nrPQO\Cookies\Chrome_Default.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2670
                                                                                                                                                                                                                                Entropy (8bit):6.023132259450377
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:JAfJUu7E01myq7lgL7E8hI7EVo9/7EyPv+7QAh7wOjUfwV7F1ZWP7wDjq7F/PqQK:KfJX48+5e4mI4O9/4yn+LhEOji8pruEL
                                                                                                                                                                                                                                MD5:F4990197183C01F3501666FE165FF243
                                                                                                                                                                                                                                SHA1:982E9C1784AE3F4A211B081923BBE8DBCBAF7D4E
                                                                                                                                                                                                                                SHA-256:1E8DDE5D6C58C5521DB98F109EA8D9ED3B5AA198747494B2AF7DBF01E9CBCE21
                                                                                                                                                                                                                                SHA-512:9FC14286879F4036A029645E474EEC4F4AC0FB9AD0488A40C8294ABA96118B9DA456FB49357A5D228515413A5FF709E407E1814263CEC529959990870D8A45A1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.google.com.TRUE./.TRUE.1712238015.NID.ENC893*_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...youtube.com.TRUE./.TRUE.1708481354.GPS.ENC893*_djEwqKmL0IcR2SmQLWzlb3JA4uArs+LhFck83HD6L38=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...www.linkedin.com.FALSE./.TRUE.18446744062065078016.JSESSIONID.ENC893*_djEwdm1W2IXRyRTXAsyGXQyuiZvkAb0swNk7VLocUMPD9ZlicOIoSkwJSNqNVjm7lKtKPcKcVAjf_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...youtube.com.TRUE./.TRUE.1724031554.VISITOR_INFO1_LIVE.ENC893*_djEwwJYr/x0KzWyrJBepa9kNluALnvuqEAIgsRENPXR6paDuAlWhRiar_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...youtube.com.TRUE./.TRUE.1724031554.VISITOR_PRIVACY_METADATA.ENC893*_djEw4P8Rgy9NADsfAyVR0Fmq2eejwyVZfpg1tOs+73ZP0ECd78kSuFeYcI

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeP9l4P_8nrPQO\information.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7935
                                                                                                                                                                                                                                Entropy (8bit):5.245817392339365
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:x0+lPbRMDc2KBhA6tsNDsGnwuGxyxBFUDBDaPZcAu6dsetIQpRypT4VBEwrwNoIW:xfReDX6tsOVCKX644dB
                                                                                                                                                                                                                                MD5:C890080231880DAA94BABA66FA853A9B
                                                                                                                                                                                                                                SHA1:B0AC6B0DBDFA39261F06F98C0008EB2270B2EDCA
                                                                                                                                                                                                                                SHA-256:2C7301255A410C28157207061531CC5C5B32F7C6B4988F8B21DAA0A9DB09B3D7
                                                                                                                                                                                                                                SHA-512:52DDDE830D04AD584F34C013F583DADF5B3EF43C94B016D0E5882B2D9490EB88DA18AD281FCB57C2E63BCB648362BEF251EC08BCB555E765625162097C690294
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Build: zhopa..Version: 1.5....Date: Wed Feb 21 02:42:44 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 0da550cf5e762d2fb230b9c9a02af5aa....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeP9l4P_8nrPQO....IP: 191.96.227.222..Location: US, New York City..Windows: Windows 10 Pro [x64]..Computer Name: 562258..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 21/2/2024 2:42:46..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788]..svchost.exe [872]..sv

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobeP9l4P_8nrPQO\passwords.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4897
                                                                                                                                                                                                                                Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobek9H6Jk7uF4lv\Cookies\Chrome_Default.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):530
                                                                                                                                                                                                                                Entropy (8bit):5.999391385907715
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
                                                                                                                                                                                                                                MD5:06ED2CD304730F55A5C7001509E128BE
                                                                                                                                                                                                                                SHA1:49651485B2CE3D239172BD52BF5A265AB3EB8E18
                                                                                                                                                                                                                                SHA-256:66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
                                                                                                                                                                                                                                SHA-512:0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893*_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...google.com.TRUE./.TRUE.1712238015.NID.ENC893*_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobek9H6Jk7uF4lv\information.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):7463
                                                                                                                                                                                                                                Entropy (8bit):5.261348616116446
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:x0+dwbRMlc2KBhA6tsNDs4unwuGxyxBFUDBDaPZcAu6dsetIQpRypT4VBEwrwNoA:xf4elX6tsO4tCAckB
                                                                                                                                                                                                                                MD5:097ABB3EABE0A6AFD990B1C84B3CC0B4
                                                                                                                                                                                                                                SHA1:6613B56CF052E871377171BEFA3C181A83B4AAB1
                                                                                                                                                                                                                                SHA-256:64B19BAC7AE778C50890C5EA4C241DD6C72F252E3B3A2B7F7609670232F2D61B
                                                                                                                                                                                                                                SHA-512:2748E696EDEB2EEBB8633585CE7ABDEFB2A0F46E4A40E87E70921FD6AA6ADC88FCE19FDA2C00B0251AFEE05670E43A99F095A624241B482905F55D1348372188
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Build: zhopa..Version: 1.5....Date: Wed Feb 21 02:39:59 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 0da550cf5e762d2fb230b9c9a02af5aa....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobek9H6Jk7uF4lv....IP: 191.96.227.222..Location: US, New York City..Windows: Windows 10 Pro [x64]..Computer Name: 562258..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 21/2/2024 2:39:59..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788]..svchost.exe [872]..sv

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobek9H6Jk7uF4lv\passwords.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4897
                                                                                                                                                                                                                                Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobezS9SzeRnCJb5\Cookies\Chrome_Default.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):530
                                                                                                                                                                                                                                Entropy (8bit):5.999391385907715
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
                                                                                                                                                                                                                                MD5:06ED2CD304730F55A5C7001509E128BE
                                                                                                                                                                                                                                SHA1:49651485B2CE3D239172BD52BF5A265AB3EB8E18
                                                                                                                                                                                                                                SHA-256:66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
                                                                                                                                                                                                                                SHA-512:0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893*_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*...google.com.TRUE./.TRUE.1712238015.NID.ENC893*_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=*..

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobezS9SzeRnCJb5\information.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5518
                                                                                                                                                                                                                                Entropy (8bit):5.313034676780737
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:x0+zJabRMlc2KBhA6tsxODs9gLnwuGxyxBFUDBDaPZcAu6dsetIQpRypT4VBEwrk:xfCelX6tsxP9gSCaB
                                                                                                                                                                                                                                MD5:F1F54605DFC37ADF6BD683AABFD20311
                                                                                                                                                                                                                                SHA1:6EE901AC89D2510A12B2435F9DBA2DA243EDBEAD
                                                                                                                                                                                                                                SHA-256:6E10230E605FAD4809B91497C3B5A825E5B89C791699FDDD467AD7685F41CE63
                                                                                                                                                                                                                                SHA-512:515E3793FCC8106E48C9AD7537237C274015EFA610B5DEACD27C2922526CC36489D37B8388D2030E068D203F76FCD92E00C87FCF46EE2B9621D7F173E94CCD6F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Build: zhopa..Version: 1.5....Date: Wed Feb 21 02:39:08 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 0da550cf5e762d2fb230b9c9a02af5aa....Path: C:\Users\user\Desktop\file.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobezS9SzeRnCJb5....IP: 191.96.227.222..Location: US, New York City..Windows: Windows 10 Pro [x64]..Computer Name: 562258..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 21/2/2024 2:39:8..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.exe [780]..fontdrvhost.exe [788]..svchost.exe [872]..svchost

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\adobezS9SzeRnCJb5\passwords.txt

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4897
                                                                                                                                                                                                                                Entropy (8bit):2.518316437186352
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                                                                                MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                                                                                SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                                                                                SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                                                                                SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\cabc923e-3512-45e9-85f4-253065a0ad19.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41902
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):76319
                                                                                                                                                                                                                                Entropy (8bit):7.996132588300074
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6w6DLZ8:GdS8scZNzFrMa4M+lK5/nEDd8
                                                                                                                                                                                                                                MD5:24439F0E82F6A60E541FB2697F02043F
                                                                                                                                                                                                                                SHA1:E3FAA84B0ED8CDD2268D53A0ECC6F3134D5EBD8F
                                                                                                                                                                                                                                SHA-256:B24DD5C374F8BB381A48605D183B6590245EE802C65F643632A3BE9BB1F313C5
                                                                                                                                                                                                                                SHA-512:8FD794657A9F80FDBC2350DC26A2C82DFD82266B934A4472B3319FDB870841C832137D4F5CE41D518859B8B1DA63031C6B7E750D301F87D6ECA45B958B147FCD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1872
                                                                                                                                                                                                                                Entropy (8bit):5.399350970681105
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr7:8e2Fa116uCntc5toYQLM
                                                                                                                                                                                                                                MD5:5C40185E3DA25332E2CFFE3B4D61D670
                                                                                                                                                                                                                                SHA1:BC145D50DFD07AD593E4A98D92B09F3B053DFFD9
                                                                                                                                                                                                                                SHA-256:13AE8058FDC3EBB151D3C2041877E3F6CA26FA37E8AB5080824DEB3E1135E888
                                                                                                                                                                                                                                SHA-512:FD56687F2522032D0BFA4B47C5E9F20FA76B3F12E10AA2A65402C46C9C6D1FED8DFFDECCEAAE6A4AF22FE98292FF45B6B5131F8FCE5523731355C26860BB3222
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\dd51a9fe-9b75-4e20-b1f2-9d4532e0beaf.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 78646
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):39452
                                                                                                                                                                                                                                Entropy (8bit):7.993679972022136
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:768:JWMwAXCguT+docvWUgSWLKcSjtFSIqtA944+veNx9dyiJnLRArLIoZ:JJ93b5HjtFbXSfvebllLerLhZ
                                                                                                                                                                                                                                MD5:90EA274BDB963D37D3AD0A14F7380A53
                                                                                                                                                                                                                                SHA1:FD2B7D84ECDE904D12FB1AC7BF59FF8B5F419D85
                                                                                                                                                                                                                                SHA-256:8D4F181FE402844963C68E2A36B7F49887F99A3B4FAC3219DE2B670289D2373B
                                                                                                                                                                                                                                SHA-512:1437C4E6A61685BB2A533388D83CB11315B94A16BF019FEE73D8D3C73C5EF71DBB12DB5D6FB661D88866DC94475B0EDAC8628DB500B8D48A0CC8DAF068383E0A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:...........}kw.H..w~.h.9.....fw$gq\.{.f.]u....3u.$.c!......7".).......4.R....WFF...j....!.M.y.M..c....$...S?M.:...g.*....%~..q....:..O...2........g.."...t.6f..'..k...>...."..W1.0[..3h6..2...z../.Y..q}3...^G.V....kY.....Pd.oc=k=...<_z.....v...8aYV.?.:....hCg!.i..p.w.Y...=.%t%.F..$...Y=.d1|....M6.g.....|.dq...Vy6..s.J.S0Z=..)H...U..U.pz......t......N.~=...tqU...~..........S...?...ty..c....o.....8C..Q`]...ui....x.....:.....>.R.O}.g....q...j.d6..AN.J...q....K..K.....k.x....v...W.w.....W...{.I..o!;"A.[.F.q.<........E.b..4.x.,.3..<.r.Q&.H.'Ek.".,..Q..~..X.).].f.y....`. !V2K. 3S... .^.h.#..|.....lu....Rd[... ....4..t..W.k..kw..o...a._d.".K..|..p"..&...<....6..jzj/...&....~.o.M....8Z.S.=.H.X.:_....|.gV...<...n7[]....../....!.f..._...$.?o./..0%......rv...`.....<..6k.Aj...!K.....)|..,.1.....~.|.kX..`.[8B,.l.{............L.R&.5X.....6...<Mgs....j....1j.S.c..k...x....,e.T3......Qg.w<m..>.S5...t.T.].=.^..~.....z.)...S<9.u.=Y....x.5.].'..3.........}.C

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\e06ccaff-57db-419e-8666-8d29f1d0c46f.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x367, components 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):684138
                                                                                                                                                                                                                                Entropy (8bit):7.974385048617555
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:Pt/rfCmAAOJlqe41bw9TxyB1SxE4+Be90FBI2t7YVcGZi+dJegoFnCCWcfYRJg:PBrKmA5zqM1Y6W4+BeeFK2xYVY0JelQE
                                                                                                                                                                                                                                MD5:3D10B83D5702F687640489C97CA111BF
                                                                                                                                                                                                                                SHA1:52D825CCAF7AA021139B181A87D2773B352F5153
                                                                                                                                                                                                                                SHA-256:DF80E350949A73F9825E2B56BE7BCF908C632406D23B3F412442727A67C60DEF
                                                                                                                                                                                                                                SHA-512:BC19748A25593A838C9AC9B0BB8EE2B8826F83CAB08207E035DC8BDDA9DC64FC16B1AB9690EDB07D60F09012A1F38B2FF0CDCEF87ECA0060C8DA24FEE9F974D1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000053060000390f00008810000019120000711f0000492f00005b300000e63100008f3300005e4e0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......o....".............................................................................)......h?.P....p......$,.....+.;.......tN.E3.7..,.+.A........@..#$...2..A...X........=<.........<G.]..Z.t/._.......$...n...9..7.w...Q{..Jm...T..'.b...y...c^......."Q..8y.3..&h..N..<.T.p'....i%.jD....S.l.zK{..HH.s..e..J..I.FGr..Z**...n~..H......e...R...C+..BT7..<.Q5...N.WG..w'..w1....a.....-&`w.....*...JIl...t.vk.|.8w"wB..u.~.i.K.wr...:.....y..-#.;.(..*.A.......'>...1.....`..{".s.7&.s.0.r.uQ..7'9.eA.w.wp/'.Z..5^..M.R._..W[u6..Z...n...I{.*.. .........zwy.......L.....^....F..._K/gi....2.i......H..u(.-.V.p....h.$..X..ezvb~..L....w..yN......*-..l.E[iJ(.&^Y.......Mb...Hb..Z..2...}..:.//>...8

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\fc3f5fea-8e81-4d41-b0ec-30adb957426e.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                File Type:Google Chrome extension, version 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98996
                                                                                                                                                                                                                                Entropy (8bit):7.702003651641397
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                                                                                MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                                                                                SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                                                                                SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                                                                                SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\h8ozYGRfpZBL_1uFxRWmLJY.zip

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2827
                                                                                                                                                                                                                                Entropy (8bit):7.72484982253082
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:9HaIL8DZIPvCbCO784fVPhanVM5jFEftB5xf5n3KJ63khOTKw:18Dq6OKV5b5atBXh3KJS
                                                                                                                                                                                                                                MD5:5EF17F8EA9EF5C690BC7CA14C37D94B9
                                                                                                                                                                                                                                SHA1:95D6BDACEB770B4F18219E910AA73443541249BB
                                                                                                                                                                                                                                SHA-256:73A6F1233D1144F6B1740CBC2ACAADE15693A1140CB10F7B36CAEDD7DB4DF380
                                                                                                                                                                                                                                SHA-512:49669DD7CE91A38F4E9CE81FBCB46B28B92D50893C7BDE8E8B8E7F4A8746D49A780D132FBC8FDD1D95B922932CB802A77B73D424767E9430B070FF2CC701B9F9
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Yara Hits:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\h8ozYGRfpZBL_1uFxRWmLJY.zip, Author: Joe Security
                                                                                                                                                                                                                                Preview:PK..........UX................Cookies\..PK..........UX..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!*.......y.o;.F..5%.....|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK..........UX..5............information.txtuX.N.H.}...hi_@....v...303.A....>t.N.p..p[.o..uE(.....S.m.n.<...[.6../[V.+..j8...Lm........c..iD8.r05.mV..1.-.zn.Q.j3.!..y..GJP..Q8O....\6...!.PH:.,1#..E..F..V/..k..ppr.h..(E.....)_...8...f..i.<3..L.7..dpc.+..#[..n}..r..G;.\...e..{.^C...KL~saW.....}..g{^L..[DN.......8....fO..v9........$...eV.........t..Q.....[.7.-.......\E.A..V.....un...\...1..G..x].n...,a.-F.....}.;S./+..q....].Y..........K].9...8..?5. -! .F..+`..b....O..)-...'... .Z

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\02zdBXl47cvzHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\2jQJv37iJ0lzCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\3GOT3GAXnZqbKvGYOMGC.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2363904
                                                                                                                                                                                                                                Entropy (8bit):7.962536812435418
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:zO/TJOsOiwul5jDwrMdS9hwLsV70KS+MWUPQjCxa:zEwS5j8raRLsW3zsC8
                                                                                                                                                                                                                                MD5:89C788DA1AF63946AA34AB15828E4BDC
                                                                                                                                                                                                                                SHA1:0B1113A1B6946990805559C15E5EE5C1771F73B2
                                                                                                                                                                                                                                SHA-256:A20F20FF15142CEF0B6AF5824830F31352148C61142899EDFE920737A208DF9C
                                                                                                                                                                                                                                SHA-512:5F949CF415AEFAD92CDA3148A03F74FD6AA5C3EBF194B4EF16283BBF153E7381E0AA189D5E21E0EBDA12EF24711618E0A80D2D3CE263B80D9D578BDEA35D171B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V........Z...........@.......................... [.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@,.........................@...jsijvwkm......@.....................@...qxzfqftw......Z.......#.............@....taggant.0....Z.."....#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\4cPGK95IIhu8co_GIahg.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                                                Entropy (8bit):7.035577580267798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8au62+b+HdiJUC:ZTvC/MTQYxsWR7au62+b+HoJU
                                                                                                                                                                                                                                MD5:B6B6A5E38DCEB1ED672ED3C1112BEC71
                                                                                                                                                                                                                                SHA1:ABA884ABDB03F5308687F42C2CA446D895BA99A7
                                                                                                                                                                                                                                SHA-256:48F95C946E797E8C5166223623484859CFAA1960EC5623D9929A65A6CE2BBFBC
                                                                                                                                                                                                                                SHA-512:110B27238A7E37189CE5B4F4404C70EC58F28B9BA570DE04D76B30EDD6E86A45C0D7155D84DE2D92CC9FF648AC82369B786D3717682DB7E20392525D5142B704
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...v@.e..........".................w.............@..........................0............@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\5Jv2cAGgCcc_tsdjHujY.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                                                Entropy (8bit):6.5811137693371
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETr:SqDEvCTbMWu7rQYlBQcBiT6rprG8akr
                                                                                                                                                                                                                                MD5:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                SHA1:808687F484CE82B23CF51886137375CC653DF1E5
                                                                                                                                                                                                                                SHA-256:28723F409F4861694F491BAEE325FB96AF0A52B7E2DB8378D8CFC342E3AB1DE2
                                                                                                                                                                                                                                SHA-512:D411FCED7D8FE40CA331D3CD405A4DD48E6C45B8640E9A68E136539296D8712FB4E45BA510FE480B02692DE3E2162A58F389DB34FC5D2536CDF58BDD701FECED
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...t@.e.........."..........R......w.............@..........................`......H.....@...@.......@.....................d...|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\D87fZN3R3jFeWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\IWPfiAXUTJTSHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.7780379659329448
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:Y/fqns3tH+bF+UI3iN0RSV0k3qLyj9ENrfqR:3nCtIkUI3iGRE3qLOpR
                                                                                                                                                                                                                                MD5:1E8B36F8E2B6652DCF85E7E70D495A61
                                                                                                                                                                                                                                SHA1:CD4CCD7E2A19C99EC62A54CD625B8AA6C2B70C41
                                                                                                                                                                                                                                SHA-256:752D112B6569D1F6A6234A0C48773B074D015B511034D5C88851A5A656A0101E
                                                                                                                                                                                                                                SHA-512:8365D55EFC8D42AA63A8F7ABC08A3DEA8B04EAE1CFE33CD33BF4A17AED6D0F7ED873C979BC856DEEA9D2B7E99CD4230E03E1BC5BE5E0E0BEB851CDFFA32A9BBC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\KvHrxJ77cmUgLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\QdX9ITDLyCRBWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\UPG2LoPXwc7OWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\ZunTSaNJLBVfWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\o0qT3dWYBP7ZHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5593809746557721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:+DJybWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEPOG:+NxhH+bDo3iN0Z2TVJkXBBE3ybS
                                                                                                                                                                                                                                MD5:13A7C48857537FD1AE1B9D9E8143159A
                                                                                                                                                                                                                                SHA1:EF63BDE4D454D7B3FE4E30E22CBE9FB4AB762C4F
                                                                                                                                                                                                                                SHA-256:8E94162D3D24434E27EFF2F1A2FFAC055BEA792A92A4DA9AF7D0161EE9284C93
                                                                                                                                                                                                                                SHA-512:7606A6EC005773153878702958F55A4349378A66301043CF7E6BFA13F0E1404C020BAF304FD9DABBC3E81F3834FE19BC68A7665E6D31DCAEBB6D6FA6D01C7632
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\pSE1jchbiT9aHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5593809746557721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:+DJybWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEPOG:+NxhH+bDo3iN0Z2TVJkXBBE3ybS
                                                                                                                                                                                                                                MD5:13A7C48857537FD1AE1B9D9E8143159A
                                                                                                                                                                                                                                SHA1:EF63BDE4D454D7B3FE4E30E22CBE9FB4AB762C4F
                                                                                                                                                                                                                                SHA-256:8E94162D3D24434E27EFF2F1A2FFAC055BEA792A92A4DA9AF7D0161EE9284C93
                                                                                                                                                                                                                                SHA-512:7606A6EC005773153878702958F55A4349378A66301043CF7E6BFA13F0E1404C020BAF304FD9DABBC3E81F3834FE19BC68A7665E6D31DCAEBB6D6FA6D01C7632
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\pZpo0gU01Jxx21DdQmVG.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1737216
                                                                                                                                                                                                                                Entropy (8bit):7.943274695914565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:ChvOpUNaR4SACjznpPE3H+ZN2c6FbyOxHrPVbKndtwY:CFOChCpPs6N291LBh
                                                                                                                                                                                                                                MD5:B8F1CE54E96098880401F6A0C2AD274C
                                                                                                                                                                                                                                SHA1:C61FEE97FA06FB06625CFA658CB575D43EE4DB6E
                                                                                                                                                                                                                                SHA-256:35F1DEE6F4326EC10D5E98510BBAD3F2ED362FCFB59B82D6589B32BCE7EF3F17
                                                                                                                                                                                                                                SHA-512:437B82376EFBA5C450D535564BF4762AE231401BD943BB1EB765664CAE27A79B2D4F238A41CF8D1EE831E3AA6776E10D23650A085BE7508FA6F6B4F7D2841682
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$...........`E.. ...`....@.. ........................E.....s.....`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... .`*..........8..............@...rgatmioc.`....+..F...:..............@...ibjqbcyw. ...`E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\q38g6uHDrjZFvFdWaIY2.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3049984
                                                                                                                                                                                                                                Entropy (8bit):7.97589377359469
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:6yGfIYR5y+pQmTaqFGRhkqftySo8Rqh7L274FFT64A58zydqI2X:67f5HpQmejXI18EfFFT64EsydqI2
                                                                                                                                                                                                                                MD5:0F243E46BF152C0E016F7C1A54BD27BB
                                                                                                                                                                                                                                SHA1:1CA165A3AF57A357B9FB5C402C44326026A733E1
                                                                                                                                                                                                                                SHA-256:76D16F92EFC5673518417B2055F6F69140425EAF0223A923B6FCA79AAB65460D
                                                                                                                                                                                                                                SHA-512:4401D896307877CD227C3DBB813666A255289DC3BCCDF1353546294E9A1366F9FC73ECBAE0CB5EB88592ED4718176E8CFBA97AA0A906A981F772BDA651B6BADF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>.......X............@..........................p............@... .. .... .. .......... ...L...l...x....................................................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........x.. ...(..................@....data.....!.......!.................@...................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\suOrwW4ZcUbjWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidi24o_MSNyMBSg\tTuIhXRskVqio6hWX3MJ.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\02zdBXl47cvzHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\2jQJv37iJ0lzCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\3JwuiAeAcxbhUfG4qx6Q.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                                                Entropy (8bit):7.035577580267798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8au62+b+HdiJUC:ZTvC/MTQYxsWR7au62+b+HoJU
                                                                                                                                                                                                                                MD5:B6B6A5E38DCEB1ED672ED3C1112BEC71
                                                                                                                                                                                                                                SHA1:ABA884ABDB03F5308687F42C2CA446D895BA99A7
                                                                                                                                                                                                                                SHA-256:48F95C946E797E8C5166223623484859CFAA1960EC5623D9929A65A6CE2BBFBC
                                                                                                                                                                                                                                SHA-512:110B27238A7E37189CE5B4F4404C70EC58F28B9BA570DE04D76B30EDD6E86A45C0D7155D84DE2D92CC9FF648AC82369B786D3717682DB7E20392525D5142B704
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...v@.e..........".................w.............@..........................0............@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\D87fZN3R3jFeWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\FAB9iVvhMHF5ed7ylOId.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                                                Entropy (8bit):6.5811137693371
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETr:SqDEvCTbMWu7rQYlBQcBiT6rprG8akr
                                                                                                                                                                                                                                MD5:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                SHA1:808687F484CE82B23CF51886137375CC653DF1E5
                                                                                                                                                                                                                                SHA-256:28723F409F4861694F491BAEE325FB96AF0A52B7E2DB8378D8CFC342E3AB1DE2
                                                                                                                                                                                                                                SHA-512:D411FCED7D8FE40CA331D3CD405A4DD48E6C45B8640E9A68E136539296D8712FB4E45BA510FE480B02692DE3E2162A58F389DB34FC5D2536CDF58BDD701FECED
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...t@.e.........."..........R......w.............@..........................`......H.....@...@.......@.....................d...|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\IWPfiAXUTJTSHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):1.0268730301621405
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:O8abfq7yFTq3S8xJStvttH+bF+UI3iN0RSV0k3qLyj9ZNO8a0T9fqR:oG7EiS8x4ntIkUI3iGRE3qLOYogR
                                                                                                                                                                                                                                MD5:7767FA3630A0C8C00A034D9E75C03DA5
                                                                                                                                                                                                                                SHA1:5D3DE92754D62BA643B5332D2B139294BC2065F2
                                                                                                                                                                                                                                SHA-256:0B85723CB5F8ADEB21E6ED45D2AB98B01CD5AC4D2F545BFE2C89701D2775D34D
                                                                                                                                                                                                                                SHA-512:E5DBE6D2E9BFB2E52621DEA0B438A0711E18F9ABE7EF561945B45AD4440051202F332CD8E792ACF4D7738D9A0FBEFEDD103A2928765A2DEE4853E984FBD6EC5F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\KvHrxJ77cmUgLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\QdX9ITDLyCRBWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\SCqW_P_cJpDWINh51hrr.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3049984
                                                                                                                                                                                                                                Entropy (8bit):7.97589377359469
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:6yGfIYR5y+pQmTaqFGRhkqftySo8Rqh7L274FFT64A58zydqI2X:67f5HpQmejXI18EfFFT64EsydqI2
                                                                                                                                                                                                                                MD5:0F243E46BF152C0E016F7C1A54BD27BB
                                                                                                                                                                                                                                SHA1:1CA165A3AF57A357B9FB5C402C44326026A733E1
                                                                                                                                                                                                                                SHA-256:76D16F92EFC5673518417B2055F6F69140425EAF0223A923B6FCA79AAB65460D
                                                                                                                                                                                                                                SHA-512:4401D896307877CD227C3DBB813666A255289DC3BCCDF1353546294E9A1366F9FC73ECBAE0CB5EB88592ED4718176E8CFBA97AA0A906A981F772BDA651B6BADF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>.......X............@..........................p............@... .. .... .. .......... ...L...l...x....................................................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........x.. ...(..................@....data.....!.......!.................@...................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\Sc7F78Jv4MgkpAFnc7lD.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2363904
                                                                                                                                                                                                                                Entropy (8bit):7.962536812435418
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:zO/TJOsOiwul5jDwrMdS9hwLsV70KS+MWUPQjCxa:zEwS5j8raRLsW3zsC8
                                                                                                                                                                                                                                MD5:89C788DA1AF63946AA34AB15828E4BDC
                                                                                                                                                                                                                                SHA1:0B1113A1B6946990805559C15E5EE5C1771F73B2
                                                                                                                                                                                                                                SHA-256:A20F20FF15142CEF0B6AF5824830F31352148C61142899EDFE920737A208DF9C
                                                                                                                                                                                                                                SHA-512:5F949CF415AEFAD92CDA3148A03F74FD6AA5C3EBF194B4EF16283BBF153E7381E0AA189D5E21E0EBDA12EF24711618E0A80D2D3CE263B80D9D578BDEA35D171B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V........Z...........@.......................... [.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@,.........................@...jsijvwkm......@.....................@...qxzfqftw......Z.......#.............@....taggant.0....Z.."....#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\UPG2LoPXwc7OWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\ZunTSaNJLBVfWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\lraj6KX6dVjpCpYcPfhj.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1737216
                                                                                                                                                                                                                                Entropy (8bit):7.943274695914565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:ChvOpUNaR4SACjznpPE3H+ZN2c6FbyOxHrPVbKndtwY:CFOChCpPs6N291LBh
                                                                                                                                                                                                                                MD5:B8F1CE54E96098880401F6A0C2AD274C
                                                                                                                                                                                                                                SHA1:C61FEE97FA06FB06625CFA658CB575D43EE4DB6E
                                                                                                                                                                                                                                SHA-256:35F1DEE6F4326EC10D5E98510BBAD3F2ED362FCFB59B82D6589B32BCE7EF3F17
                                                                                                                                                                                                                                SHA-512:437B82376EFBA5C450D535564BF4762AE231401BD943BB1EB765664CAE27A79B2D4F238A41CF8D1EE831E3AA6776E10D23650A085BE7508FA6F6B4F7D2841682
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$...........`E.. ...`....@.. ........................E.....s.....`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... .`*..........8..............@...rgatmioc.`....+..F...:..............@...ibjqbcyw. ...`E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\o0qT3dWYBP7ZHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5702380039713865
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:+eJbPWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEkOG:+eyhH+bDo3iN0Z2TVJkXBBE3ybR
                                                                                                                                                                                                                                MD5:BD76AC3DF782F0A1B5D55B4956F20076
                                                                                                                                                                                                                                SHA1:11EAF71C11708C07C5D10DE586EE278D01167800
                                                                                                                                                                                                                                SHA-256:EDD8DE6F4CE8B49C557B7C335F8704FBDAE87678EF9E0E6A1053C0610407C718
                                                                                                                                                                                                                                SHA-512:E6A474FFB7051E59176561C6CC215196F28CADA58B0637C4842820AF9B62C5C297A0C2AB56606CDDDE6A8B8A2F8AEE7DEE5A645CC90C45FD69C368076C33AD92
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\oOPEmFmu_xsJCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):1.8369455414378681
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:9xe+nMey09+7zLzC+WewFuZCh1Si28jUKeEbf+9q7hQzdi5xB:9xP3+fvBmFaTEbfpF
                                                                                                                                                                                                                                MD5:F836B3DFF4DB876CE94B0BCF937D01FF
                                                                                                                                                                                                                                SHA1:2A963F6A7092573FAFFF8B861C3EE97797D04443
                                                                                                                                                                                                                                SHA-256:104844EB4D80FB66196246A30B80491D5FF49AAB20EB407F9F3DF8963C7C78FF
                                                                                                                                                                                                                                SHA-512:4EB9957B623DA9A2761E426D21A0EF9F96EB3982B3CBAB483D1A519E3E691029ECA6DCC6208722C657A08544DBD617E53DC306B40FA3745BBE3C9C1AB7087C3D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\pSE1jchbiT9aHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5702380039713865
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:+eJbPWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEkOG:+eyhH+bDo3iN0Z2TVJkXBBE3ybR
                                                                                                                                                                                                                                MD5:BD76AC3DF782F0A1B5D55B4956F20076
                                                                                                                                                                                                                                SHA1:11EAF71C11708C07C5D10DE586EE278D01167800
                                                                                                                                                                                                                                SHA-256:EDD8DE6F4CE8B49C557B7C335F8704FBDAE87678EF9E0E6A1053C0610407C718
                                                                                                                                                                                                                                SHA-512:E6A474FFB7051E59176561C6CC215196F28CADA58B0637C4842820AF9B62C5C297A0C2AB56606CDDDE6A8B8A2F8AEE7DEE5A645CC90C45FD69C368076C33AD92
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\suOrwW4ZcUbjWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidiP9l4P_8nrPQO\tL_fuTzDWfh0VWCLkvvf.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\02zdBXl47cvzHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\2fck4tppkbHBVDQlLEGf.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3049984
                                                                                                                                                                                                                                Entropy (8bit):7.97589377359469
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:6yGfIYR5y+pQmTaqFGRhkqftySo8Rqh7L274FFT64A58zydqI2X:67f5HpQmejXI18EfFFT64EsydqI2
                                                                                                                                                                                                                                MD5:0F243E46BF152C0E016F7C1A54BD27BB
                                                                                                                                                                                                                                SHA1:1CA165A3AF57A357B9FB5C402C44326026A733E1
                                                                                                                                                                                                                                SHA-256:76D16F92EFC5673518417B2055F6F69140425EAF0223A923B6FCA79AAB65460D
                                                                                                                                                                                                                                SHA-512:4401D896307877CD227C3DBB813666A255289DC3BCCDF1353546294E9A1366F9FC73ECBAE0CB5EB88592ED4718176E8CFBA97AA0A906A981F772BDA651B6BADF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>.......X............@..........................p............@... .. .... .. .......... ...L...l...x....................................................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........x.. ...(..................@....data.....!.......!.................@...................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\2jQJv37iJ0lzCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\ApPQmeGzxQP3KtH6lKvJ.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1737216
                                                                                                                                                                                                                                Entropy (8bit):7.943274695914565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:ChvOpUNaR4SACjznpPE3H+ZN2c6FbyOxHrPVbKndtwY:CFOChCpPs6N291LBh
                                                                                                                                                                                                                                MD5:B8F1CE54E96098880401F6A0C2AD274C
                                                                                                                                                                                                                                SHA1:C61FEE97FA06FB06625CFA658CB575D43EE4DB6E
                                                                                                                                                                                                                                SHA-256:35F1DEE6F4326EC10D5E98510BBAD3F2ED362FCFB59B82D6589B32BCE7EF3F17
                                                                                                                                                                                                                                SHA-512:437B82376EFBA5C450D535564BF4762AE231401BD943BB1EB765664CAE27A79B2D4F238A41CF8D1EE831E3AA6776E10D23650A085BE7508FA6F6B4F7D2841682
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$...........`E.. ...`....@.. ........................E.....s.....`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... .`*..........8..............@...rgatmioc.`....+..F...:..............@...ibjqbcyw. ...`E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\D87fZN3R3jFeWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\IWPfiAXUTJTSHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\KvHrxJ77cmUgLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\QdX9ITDLyCRBWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\TrXOE37ZBs5VYYL1rLei.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                                                Entropy (8bit):7.035577580267798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8au62+b+HdiJUC:ZTvC/MTQYxsWR7au62+b+HoJU
                                                                                                                                                                                                                                MD5:B6B6A5E38DCEB1ED672ED3C1112BEC71
                                                                                                                                                                                                                                SHA1:ABA884ABDB03F5308687F42C2CA446D895BA99A7
                                                                                                                                                                                                                                SHA-256:48F95C946E797E8C5166223623484859CFAA1960EC5623D9929A65A6CE2BBFBC
                                                                                                                                                                                                                                SHA-512:110B27238A7E37189CE5B4F4404C70EC58F28B9BA570DE04D76B30EDD6E86A45C0D7155D84DE2D92CC9FF648AC82369B786D3717682DB7E20392525D5142B704
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...v@.e..........".................w.............@..........................0............@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\UPG2LoPXwc7OWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\Utp0jUqZeU8scbGMpad8.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2363904
                                                                                                                                                                                                                                Entropy (8bit):7.962536812435418
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:zO/TJOsOiwul5jDwrMdS9hwLsV70KS+MWUPQjCxa:zEwS5j8raRLsW3zsC8
                                                                                                                                                                                                                                MD5:89C788DA1AF63946AA34AB15828E4BDC
                                                                                                                                                                                                                                SHA1:0B1113A1B6946990805559C15E5EE5C1771F73B2
                                                                                                                                                                                                                                SHA-256:A20F20FF15142CEF0B6AF5824830F31352148C61142899EDFE920737A208DF9C
                                                                                                                                                                                                                                SHA-512:5F949CF415AEFAD92CDA3148A03F74FD6AA5C3EBF194B4EF16283BBF153E7381E0AA189D5E21E0EBDA12EF24711618E0A80D2D3CE263B80D9D578BDEA35D171B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V........Z...........@.......................... [.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@,.........................@...jsijvwkm......@.....................@...qxzfqftw......Z.......#.............@....taggant.0....Z.."....#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\ZunTSaNJLBVfWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\o0qT3dWYBP7ZHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5593809746557721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:+DJybWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEPOG:+NxhH+bDo3iN0Z2TVJkXBBE3ybS
                                                                                                                                                                                                                                MD5:13A7C48857537FD1AE1B9D9E8143159A
                                                                                                                                                                                                                                SHA1:EF63BDE4D454D7B3FE4E30E22CBE9FB4AB762C4F
                                                                                                                                                                                                                                SHA-256:8E94162D3D24434E27EFF2F1A2FFAC055BEA792A92A4DA9AF7D0161EE9284C93
                                                                                                                                                                                                                                SHA-512:7606A6EC005773153878702958F55A4349378A66301043CF7E6BFA13F0E1404C020BAF304FD9DABBC3E81F3834FE19BC68A7665E6D31DCAEBB6D6FA6D01C7632
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\oOPEmFmu_xsJCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.8439810553697228
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
                                                                                                                                                                                                                                MD5:9D46F142BBCF25D0D495FF1F3A7609D3
                                                                                                                                                                                                                                SHA1:629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
                                                                                                                                                                                                                                SHA-256:C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
                                                                                                                                                                                                                                SHA-512:AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\ow5lYGAMAmmdqAMRBUVa.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                                                Entropy (8bit):6.5811137693371
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETr:SqDEvCTbMWu7rQYlBQcBiT6rprG8akr
                                                                                                                                                                                                                                MD5:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                SHA1:808687F484CE82B23CF51886137375CC653DF1E5
                                                                                                                                                                                                                                SHA-256:28723F409F4861694F491BAEE325FB96AF0A52B7E2DB8378D8CFC342E3AB1DE2
                                                                                                                                                                                                                                SHA-512:D411FCED7D8FE40CA331D3CD405A4DD48E6C45B8640E9A68E136539296D8712FB4E45BA510FE480B02692DE3E2162A58F389DB34FC5D2536CDF58BDD701FECED
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...t@.e.........."..........R......w.............@..........................`......H.....@...@.......@.....................d...|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\pSE1jchbiT9aHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5593809746557721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:+DJybWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kEPOG:+NxhH+bDo3iN0Z2TVJkXBBE3ybS
                                                                                                                                                                                                                                MD5:13A7C48857537FD1AE1B9D9E8143159A
                                                                                                                                                                                                                                SHA1:EF63BDE4D454D7B3FE4E30E22CBE9FB4AB762C4F
                                                                                                                                                                                                                                SHA-256:8E94162D3D24434E27EFF2F1A2FFAC055BEA792A92A4DA9AF7D0161EE9284C93
                                                                                                                                                                                                                                SHA-512:7606A6EC005773153878702958F55A4349378A66301043CF7E6BFA13F0E1404C020BAF304FD9DABBC3E81F3834FE19BC68A7665E6D31DCAEBB6D6FA6D01C7632
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\suOrwW4ZcUbjWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.2649296740068894
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/2qOB1nxCkMrSAELyKOMq+8yC8F/YfU5m+OlTLVumU:Bq+n0Jr9ELyKOMq+8y9/OwD
                                                                                                                                                                                                                                MD5:009F45321B1E87F45473CC2F5055972B
                                                                                                                                                                                                                                SHA1:0050B85012D3D20EEF8CCA163009CA53B0AC6D83
                                                                                                                                                                                                                                SHA-256:3AE1473A44A158F45E122049B7EE4F30CB7E4E0EFFF947DC0B7F11E178C39DDF
                                                                                                                                                                                                                                SHA-512:EC6E2AB186A069089D1673DD0115E14FF65E670B82FA7205AE2E54C514C30F19DFD39D35280A87750E7802B51279F6DD0C9AC90AC5077B031843C7AA0C8914C1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidik9H6Jk7uF4lv\vyOycan6EgXUKkno1qul.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\02zdBXl47cvzHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):98304
                                                                                                                                                                                                                                Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):918016
                                                                                                                                                                                                                                Entropy (8bit):6.5811137693371
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:SqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaETr:SqDEvCTbMWu7rQYlBQcBiT6rprG8akr
                                                                                                                                                                                                                                MD5:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                SHA1:808687F484CE82B23CF51886137375CC653DF1E5
                                                                                                                                                                                                                                SHA-256:28723F409F4861694F491BAEE325FB96AF0A52B7E2DB8378D8CFC342E3AB1DE2
                                                                                                                                                                                                                                SHA-512:D411FCED7D8FE40CA331D3CD405A4DD48E6C45B8640E9A68E136539296D8712FB4E45BA510FE480B02692DE3E2162A58F389DB34FC5D2536CDF58BDD701FECED
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...t@.e.........."..........R......w.............@..........................`......H.....@...@.......@.....................d...|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\2jQJv37iJ0lzCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\D87fZN3R3jFeWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):5242880
                                                                                                                                                                                                                                Entropy (8bit):0.03859996294213402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
                                                                                                                                                                                                                                MD5:D2A38A463B7925FE3ABE31ECCCE66ACA
                                                                                                                                                                                                                                SHA1:A1824888F9E086439B287DEA497F660F3AA4B397
                                                                                                                                                                                                                                SHA-256:474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
                                                                                                                                                                                                                                SHA-512:62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):40960
                                                                                                                                                                                                                                Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\IWPfiAXUTJTSHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):159744
                                                                                                                                                                                                                                Entropy (8bit):0.5394293526345721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                                                                                MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                                                                                SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                                                                                SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                                                                                SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\KvHrxJ77cmUgLogin Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):51200
                                                                                                                                                                                                                                Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\MF0uP9gfhtzQk0nmPHvh.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):2363904
                                                                                                                                                                                                                                Entropy (8bit):7.962536812435418
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:zO/TJOsOiwul5jDwrMdS9hwLsV70KS+MWUPQjCxa:zEwS5j8raRLsW3zsC8
                                                                                                                                                                                                                                MD5:89C788DA1AF63946AA34AB15828E4BDC
                                                                                                                                                                                                                                SHA1:0B1113A1B6946990805559C15E5EE5C1771F73B2
                                                                                                                                                                                                                                SHA-256:A20F20FF15142CEF0B6AF5824830F31352148C61142899EDFE920737A208DF9C
                                                                                                                                                                                                                                SHA-512:5F949CF415AEFAD92CDA3148A03F74FD6AA5C3EBF194B4EF16283BBF153E7381E0AA189D5E21E0EBDA12EF24711618E0A80D2D3CE263B80D9D578BDEA35D171B
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V........Z...........@.......................... [.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... .@,.........................@...jsijvwkm......@.....................@...qxzfqftw......Z.......#.............@....taggant.0....Z.."....#.............@...................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\N6QvjPQDZQjnaZdnVBvT.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3049984
                                                                                                                                                                                                                                Entropy (8bit):7.97589377359469
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:6yGfIYR5y+pQmTaqFGRhkqftySo8Rqh7L274FFT64A58zydqI2X:67f5HpQmejXI18EfFFT64EsydqI2
                                                                                                                                                                                                                                MD5:0F243E46BF152C0E016F7C1A54BD27BB
                                                                                                                                                                                                                                SHA1:1CA165A3AF57A357B9FB5C402C44326026A733E1
                                                                                                                                                                                                                                SHA-256:76D16F92EFC5673518417B2055F6F69140425EAF0223A923B6FCA79AAB65460D
                                                                                                                                                                                                                                SHA-512:4401D896307877CD227C3DBB813666A255289DC3BCCDF1353546294E9A1366F9FC73ECBAE0CB5EB88592ED4718176E8CFBA97AA0A906A981F772BDA651B6BADF
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L....~.e...............".....>.......X............@..........................p............@... .. .... .. .......... ...L...l...x....................................................................................................................................4..................@............p......."...8..............@............@...0.......Z..............@................p.......b..............@....................d...b..............@....rsrc...............................@..@..........x.. ...(..................@....data.....!.......!.................@...................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\Oqz1gKr60kpGbxg1Y8oi.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1737216
                                                                                                                                                                                                                                Entropy (8bit):7.943274695914565
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:ChvOpUNaR4SACjznpPE3H+ZN2c6FbyOxHrPVbKndtwY:CFOChCpPs6N291LBh
                                                                                                                                                                                                                                MD5:B8F1CE54E96098880401F6A0C2AD274C
                                                                                                                                                                                                                                SHA1:C61FEE97FA06FB06625CFA658CB575D43EE4DB6E
                                                                                                                                                                                                                                SHA-256:35F1DEE6F4326EC10D5E98510BBAD3F2ED362FCFB59B82D6589B32BCE7EF3F17
                                                                                                                                                                                                                                SHA-512:437B82376EFBA5C450D535564BF4762AE231401BD943BB1EB765664CAE27A79B2D4F238A41CF8D1EE831E3AA6776E10D23650A085BE7508FA6F6B4F7D2841682
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$...........`E.. ...`....@.. ........................E.....s.....`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... .`*..........8..............@...rgatmioc.`....+..F...:..............@...ibjqbcyw. ...`E.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\QdX9ITDLyCRBWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):106496
                                                                                                                                                                                                                                Entropy (8bit):1.136413900497188
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
                                                                                                                                                                                                                                MD5:429F49156428FD53EB06FC82088FD324
                                                                                                                                                                                                                                SHA1:560E48154B4611838CD4E9DF4C14D0F9840F06AF
                                                                                                                                                                                                                                SHA-256:9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
                                                                                                                                                                                                                                SHA-512:1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\UPG2LoPXwc7OWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\ZunTSaNJLBVfWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1889792
                                                                                                                                                                                                                                Entropy (8bit):7.949142083605219
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:BNepawCLu/fXb1MBSoGkB2yAos5Mu6dVOs:BopNnBwPGMAod
                                                                                                                                                                                                                                MD5:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                SHA1:94252FAD0C35A368F85B6FD64371605BD1B4B1A0
                                                                                                                                                                                                                                SHA-256:4A38B0E496DA1CAEA4A2900D0ACAC96E6143F35391BD3C682295F64F7E02F890
                                                                                                                                                                                                                                SHA-512:084F0C30DDCDD6814EDAF7253270A74FD83D61E473A786B22AA1AE24462C384609E694171958CC56BE45A9AE92DB23ABE6BE9F0593AEE5ED4175ED3C4E6D60F6
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e..............................J...........@...........................J......U....@.................................Vp..j....`.......................J...............................J..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .P*.........................@...wplfwedx......0.....................@...ykkhrrnz......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\d34xW9C7tg9XChbetTr2.exe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1166336
                                                                                                                                                                                                                                Entropy (8bit):7.035577580267798
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZqDEvCTbMWu7rQYlBQcBiT6rprG8au62+b+HdiJUC:ZTvC/MTQYxsWR7au62+b+HoJU
                                                                                                                                                                                                                                MD5:B6B6A5E38DCEB1ED672ED3C1112BEC71
                                                                                                                                                                                                                                SHA1:ABA884ABDB03F5308687F42C2CA446D895BA99A7
                                                                                                                                                                                                                                SHA-256:48F95C946E797E8C5166223623484859CFAA1960EC5623D9929A65A6CE2BBFBC
                                                                                                                                                                                                                                SHA-512:110B27238A7E37189CE5B4F4404C70EC58F28B9BA570DE04D76B30EDD6E86A45C0D7155D84DE2D92CC9FF648AC82369B786D3717682DB7E20392525D5142B704
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...v@.e..........".................w.............@..........................0............@...@.......@.....................d...|....@..|a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...|a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\o0qT3dWYBP7ZHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\oOPEmFmu_xsJCookies

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):20480
                                                                                                                                                                                                                                Entropy (8bit):0.8439810553697228
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
                                                                                                                                                                                                                                MD5:9D46F142BBCF25D0D495FF1F3A7609D3
                                                                                                                                                                                                                                SHA1:629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
                                                                                                                                                                                                                                SHA-256:C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
                                                                                                                                                                                                                                SHA-512:AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\pSE1jchbiT9aHistory

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):155648
                                                                                                                                                                                                                                Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\suOrwW4ZcUbjWeb Data

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):196608
                                                                                                                                                                                                                                Entropy (8bit):1.121297215059106
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
                                                                                                                                                                                                                                MD5:D87270D0039ED3A5A72E7082EA71E305
                                                                                                                                                                                                                                SHA1:0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
                                                                                                                                                                                                                                SHA-256:F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
                                                                                                                                                                                                                                SHA-512:18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.4593089050301797
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                                                                                                                                                                                                MD5:D910AD167F0217587501FDCDB33CC544
                                                                                                                                                                                                                                SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                                                                                                                                                                                                SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                                                                                                                                                                                                SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\rage131MP.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13
                                                                                                                                                                                                                                Entropy (8bit):2.873140679513133
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:L3SIQn:LhQn
                                                                                                                                                                                                                                MD5:67025BFC8DB6B216B7C71C2D4EFC5172
                                                                                                                                                                                                                                SHA1:A48A58D3FD77FDC265C37CFABDCECF799C37E545
                                                                                                                                                                                                                                SHA-256:525E228CF28D48F06F00C9AFA82CF053A34368A1B6EDB5539428CC95D1308DF3
                                                                                                                                                                                                                                SHA-512:54E296DDC09DF694A9A63C5991D20CA9D2D8AD93C9231065B161CCAC74BAA1A1348BB7D27FBFE6DAEEB873E2F130553BCCCCEA3AAF5DA4C0EAAA4FD2BBDB73D8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:1708483589134

                                                                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmpaddon

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):453023
                                                                                                                                                                                                                                Entropy (8bit):7.997718157581587
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                                                                                                                                                                                                MD5:85430BAED3398695717B0263807CF97C
                                                                                                                                                                                                                                SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                                                                                                                                                                                                SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                                                                                                                                                                                                SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 21 00:39:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2677
                                                                                                                                                                                                                                Entropy (8bit):3.978957853737454
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:8BdZTFLRKHgidAKZdA19ehwiZUklqehRy+3:8l51F+y
                                                                                                                                                                                                                                MD5:E25C1F97B83F87C6C24A94EC55DB275B
                                                                                                                                                                                                                                SHA1:FDDA3990D138C4863283F530C18D99E2BF9E7E8F
                                                                                                                                                                                                                                SHA-256:9FD17FAF6B140C733A0419F1A93B03D58700899D5F6D756EBFC68B1CE3044F54
                                                                                                                                                                                                                                SHA-512:1D7B25D2D25AD00122020E4836D334F1ED83BDAC2BDDBC116EFC45270FB8B31E19B7F003E6D9B25EB731EAA59BB48C5359B16F13864681BC206A337AF9C38468
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:L..................F.@.. ...$+.,....Zt..fd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IUX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 21 00:39:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2679
                                                                                                                                                                                                                                Entropy (8bit):3.9926380171298863
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:83dZTFLRKHgidAKZdA1weh/iZUkAQkqehuy+2:8P51f9Qzy
                                                                                                                                                                                                                                MD5:2EAA1F84E1BE3F4F36291A85AE28FA5D
                                                                                                                                                                                                                                SHA1:220AC4E63FAC5715AD83B52CE0CDD7044FA0347B
                                                                                                                                                                                                                                SHA-256:BEB79440027D181AD52507C63D425B9799C6DAEBB8CDEF03808F7AF58D219D5E
                                                                                                                                                                                                                                SHA-512:D2F54FC81FE41DDE4EE3D54823C72C7F83923DD3E88EA85B51C072D4A7AB0F6E0CDE93D8484047A244BA0BBC948469F9F5FFFCC0009859B288AFFEA197ACD7CA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:L..................F.@.. ...$+.,.......fd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IUX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2693
                                                                                                                                                                                                                                Entropy (8bit):4.005591638714964
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:8xCdZTFLRsHgidAKZdA14tseh7sFiZUkmgqeh7sYy+BX:8xM51xnqy
                                                                                                                                                                                                                                MD5:6477A5D8537A68C73D8A8FFB978CBA7C
                                                                                                                                                                                                                                SHA1:3F9F4514E99F8969491704A8E33E17D44F05F660
                                                                                                                                                                                                                                SHA-256:67E0E60D9BC55AEAF9C47DC9ACDFF76A20DBE6F254A299529478AAA1426BBC3F
                                                                                                                                                                                                                                SHA-512:343F6C1AB81719B8139CA4BF4CCF0D058EF5006DDE046D9C83860DABA600A7F6DF9336612A1D8B5A5905E4DCD5FA007430CBCFA2A94074BFA8D63CFD72E41D2D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IUX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 21 00:39:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2681
                                                                                                                                                                                                                                Entropy (8bit):3.993199252043803
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:8HdZTFLRKHgidAKZdA1vehDiZUkwqehCy+R:8f51cQy
                                                                                                                                                                                                                                MD5:97011F3C3529F26CB5879987DC74E2A1
                                                                                                                                                                                                                                SHA1:6ABA009429A201FDA4BEBAAE6B6D620E6E8DA5E9
                                                                                                                                                                                                                                SHA-256:2220819ED5A7608EB026B8253EA5370A1F19EE6D0824C445ACE692F56128B6C6
                                                                                                                                                                                                                                SHA-512:0D1CA792C61F53F09BCC8DA3D1AEB00FA827A82239BF0CE729D765A0C8FFC7F5E954F5AC2A012F8C861A9468D5036BDF11B46A34479F91127EBE7689996A333F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:L..................F.@.. ...$+.,........fd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IUX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 21 00:39:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2681
                                                                                                                                                                                                                                Entropy (8bit):3.9827132758819683
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:8IdZTFLRKHgidAKZdA1hehBiZUk1W1qehEy+C:8G51s9ky
                                                                                                                                                                                                                                MD5:E772FFD769E0008B0F6EEFA1D115DE14
                                                                                                                                                                                                                                SHA1:45C8AF507A70B1D5514D0A7CB0E395D1B153DA73
                                                                                                                                                                                                                                SHA-256:707AE80E43ECC5533DE5F17877EC4F995A3DEE06A2961069E2CF95ED4218E5A9
                                                                                                                                                                                                                                SHA-512:2B9F51F96624A1E5B7DA710FF6445E8669643EEFBDFF2BE3FF258BA4D22BD4F79AE4C44B7E68000133679B2C69EAD46E9F6208C5B5B37CE6DB6AF99503131C28
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:L..................F.@.. ...$+.,....Y...fd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IUX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 21 00:39:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2683
                                                                                                                                                                                                                                Entropy (8bit):3.9929578346554764
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:8ldZTFLRKHgidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbqy+yT+:8h51CT/TbxWOvTbqy7T
                                                                                                                                                                                                                                MD5:48C4EA2C58D793A2B5424034BA99583A
                                                                                                                                                                                                                                SHA1:D8133A22BA39E37A789257F17797A51299754B6A
                                                                                                                                                                                                                                SHA-256:F062132F35B62301FE580EC1E74C140AC6DC4439E80FBFF080FC4FC5FBFFDC0F
                                                                                                                                                                                                                                SHA-512:A365A7B94A5B423FB61746E2D604745E4D4313DC2E871308FDA69CB48C3799906EC2A129D3E3998D6B015851318240BCDE7BF940D05473E226DDE374FE785CA7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:L..................F.@.. ...$+.,.......fd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IUX......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VUX......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VUX......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VUX............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VUX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........X........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Wed Feb 21 00:39:19 2024, mtime=Wed Feb 21 00:39:19 2024, atime=Wed Feb 21 00:39:12 2024, length=1889792, window=hide
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1191
                                                                                                                                                                                                                                Entropy (8bit):4.896587742819787
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:8ikP4fo88CjlsagMRahgKYy68yU04cs3kQ2a3l3lAjAcDd3Z1zs3es3qawuLk14C:8SfT84JRCgKYsG4d3sAKjOEnqygm
                                                                                                                                                                                                                                MD5:5FDFFAF21D97A2837F4379861AAAEC35
                                                                                                                                                                                                                                SHA1:5D8A35374DB75DC1BFD3DEC9A519E9D2A30008D0
                                                                                                                                                                                                                                SHA-256:CFB1B989DD29426D58DC50DA110358C4232DAC10FF8BE36567988A050D7535D4
                                                                                                                                                                                                                                SHA-512:C98B51F9D98618556CF0B23D5A2B0122A4F37EE2AF5B9DD6DB681DBEB8DADC393735F2401E1B6063EE86208C29CC4899C1109CB333DF8F285D2BF19843F15EF1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:L..................F.... ...H...fd...+..fd.....fd.......................... .:..DG..Yr?.D..U..k0.&...&...... M......]..fd....-.fd......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlUX......B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....UX....Local.<......DWSlUX......V.........................L.o.c.a.l.....N.1.....UX....Temp..:......DWSlUX......\.......................b.T.e.m.p.....\.1.....UX....EDGEMS~1..D......UX..UX......./......................,.E.d.g.e.M.S.1.3.1.....h.2.....UX.. .EDGEMS~1.EXE..L......UX..UX......./........................E.d.g.e.M.S.1.3.1...e.x.e.......i...............-.......h...........X........C:\Users\user\AppData\Local\Temp\EdgeMS131\EdgeMS131.exe....E.d.g.e.M.S.1.3.1.4.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.M.S.1.3.1.\.E.d.g.e.M.S.1.3.1...e.x.e.........|....I.J.H..K..:...`.......X.......562258...........hT..CrF.f4... .2.2=.b...,...W..hT..CrF.f4... .2.2=.b...,...W..............1SPS.XF.L8

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3621
                                                                                                                                                                                                                                Entropy (8bit):4.923517842792276
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNO9nxeln:8S+OVPUFRbOdwNIOdYpjvY1Q6LZ98P
                                                                                                                                                                                                                                MD5:45992538A9B386A4B78644000039CB78
                                                                                                                                                                                                                                SHA1:FBC22A3C8F6BFBAB7ED0BDD33EAA88BE5D134F71
                                                                                                                                                                                                                                SHA-256:BEFDE4D47591AD19A0C4A6AF73BED687203603F75F6422B7A186A97DDDB54B32
                                                                                                                                                                                                                                SHA-512:AD7E1505F340502DC73562A5E6A2CA5A0216BB85EBFF52ABF6C7AA540BC9B7CF8666CD242943F88501BBBB3CF793FFF77D1C34218AB3564E4E96F93A1FCD774E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):3621
                                                                                                                                                                                                                                Entropy (8bit):4.923517842792276
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:YnSwkmrOVPUFRbOdwNIOdoWLEWLtkDZuwpx5FBvipA6kb92the6LuhakNO9nxeln:8S+OVPUFRbOdwNIOdYpjvY1Q6LZ98P
                                                                                                                                                                                                                                MD5:45992538A9B386A4B78644000039CB78
                                                                                                                                                                                                                                SHA1:FBC22A3C8F6BFBAB7ED0BDD33EAA88BE5D134F71
                                                                                                                                                                                                                                SHA-256:BEFDE4D47591AD19A0C4A6AF73BED687203603F75F6422B7A186A97DDDB54B32
                                                                                                                                                                                                                                SHA-512:AD7E1505F340502DC73562A5E6A2CA5A0216BB85EBFF52ABF6C7AA540BC9B7CF8666CD242943F88501BBBB3CF793FFF77D1C34218AB3564E4E96F93A1FCD774E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 26944 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6071
                                                                                                                                                                                                                                Entropy (8bit):6.61263436125208
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:72YbKsKNU2xWrp327tGmD4wBON6hCY9rI7hlSAJVrfzjZXjkTndS12opTaM:7Tx2x2t0FDJ4NF6ILDfzjtedh6TX
                                                                                                                                                                                                                                MD5:FD36D36BC5077FC3D16CD68CC7FFC65A
                                                                                                                                                                                                                                SHA1:2111D7339EA8F94FC7F4F8E2964ABDBE6198F90B
                                                                                                                                                                                                                                SHA-256:3A65636ABBCBF9BC2447FEA1BCE9BFC0E6DACD10D5721D21D670A537FFF0D545
                                                                                                                                                                                                                                SHA-512:074547A0C2D572BA22D27A4EC3A0957C27B72E732D0ED37501C30A9657CAD258584819D3A92215B52638888D9FC0682E871F454B0ECBFC75373CBAE38DA4D656
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40.@i....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 26944 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):6071
                                                                                                                                                                                                                                Entropy (8bit):6.61263436125208
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:72YbKsKNU2xWrp327tGmD4wBON6hCY9rI7hlSAJVrfzjZXjkTndS12opTaM:7Tx2x2t0FDJ4NF6ILDfzjtedh6TX
                                                                                                                                                                                                                                MD5:FD36D36BC5077FC3D16CD68CC7FFC65A
                                                                                                                                                                                                                                SHA1:2111D7339EA8F94FC7F4F8E2964ABDBE6198F90B
                                                                                                                                                                                                                                SHA-256:3A65636ABBCBF9BC2447FEA1BCE9BFC0E6DACD10D5721D21D670A537FFF0D545
                                                                                                                                                                                                                                SHA-512:074547A0C2D572BA22D27A4EC3A0957C27B72E732D0ED37501C30A9657CAD258584819D3A92215B52638888D9FC0682E871F454B0ECBFC75373CBAE38DA4D656
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40.@i....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):24
                                                                                                                                                                                                                                Entropy (8bit):3.91829583405449
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                                                MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                                                SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                                                SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                                                SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):24
                                                                                                                                                                                                                                Entropy (8bit):3.91829583405449
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                                                MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                                                SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                                                SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                                                SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):262144
                                                                                                                                                                                                                                Entropy (8bit):0.04905141882491872
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
                                                                                                                                                                                                                                MD5:8736A542C5564A922C47B19D9CC5E0F2
                                                                                                                                                                                                                                SHA1:CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
                                                                                                                                                                                                                                SHA-256:97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
                                                                                                                                                                                                                                SHA-512:99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite-journal

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):33288
                                                                                                                                                                                                                                Entropy (8bit):0.3088264878988991
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:7+tWn6LCvwae+Q8Uu50xj0aWe9LxYkKA25Q5yP:7Mw6awae+QtMImelekKDa5yP
                                                                                                                                                                                                                                MD5:C7540720E2CF2449E9AB6684B36C4A4E
                                                                                                                                                                                                                                SHA1:A8AD1AA07670FC09F5D49A7B3C26AF0B46A20520
                                                                                                                                                                                                                                SHA-256:7BD04CB929A9D31F8CDE5B685A5C6D3B62F47B58261A83B71DEB69608F1679FA
                                                                                                                                                                                                                                SHA-512:4B856F5B9BFBE2501CB866FECCAABA55A2AEF6E64D3211FADFA126AD00D8D577F3556B779996FF87A59EE5CC774B8D3073ED195B2088B0D10D56E7D3568D81B9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.... .c.......f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):66
                                                                                                                                                                                                                                Entropy (8bit):4.837595020998689
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                                                MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                                                SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                                                SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                                                SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):66
                                                                                                                                                                                                                                Entropy (8bit):4.837595020998689
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                                                MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                                                SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                                                SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                                                SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\aborted-session-ping (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):47779
                                                                                                                                                                                                                                Entropy (8bit):5.24946636179387
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zopVEa862P+vnYUktwwve8xb9NoVUn1oCP3B7sNhnzFSJwZt:zo422m5Dwj4CoCP2NhnzFSJu
                                                                                                                                                                                                                                MD5:A4CDE641D9811CC80C3A89DAEFBAF29A
                                                                                                                                                                                                                                SHA1:52B656C252D30D3F058127F9ECF3383D540BF4C1
                                                                                                                                                                                                                                SHA-256:FC61101AC47E0ED6D8D25DDF38F26D9CE8746DC58E4859CD0429708B444E8BC6
                                                                                                                                                                                                                                SHA-512:CCD50E5F8F794AA6EAF1357C0ED774C38282A214FEB459AE8017C8091322C2E79643BF3A2E6172105C22CDCEA1F26F7511D9361F0B44D9B89213C7DC9F24801C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"type":"main","id":"6240bfcf-dfed-4e23-899e-b04f91c65450","creationDate":"2024-02-21T02:47:34.641Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":8111,"start":4015825,"main":4016941,"selectProfile":4016954,"afterProfileLocked":4016958,"startupCrashDetectionBegin":4021703,"firstPaint":4025277,"firstPaint2":4024607,"sessionRestoreInit":4022251,"sessionRestored":4027061,"createTopLevelWindow":4017665,"blankWindowShown":8037047,"AMI_startup_begin":8037151,"XPI_startup_begin":8037245,"XPI_bootstrap_addons_begin":8037249,"XPI_bootstrap_addons_end":8037305,"XPI_startup_end":8037305,"AMI_startup_end":8037306,"XPI_finalUIStartup":8037595,"sessionRestoreInitialized":8037605,"delayedStartupStarted":8041225,"delayedStartupFinished":8041733,"startupInterrupted

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\aborted-session-ping.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):47779
                                                                                                                                                                                                                                Entropy (8bit):5.24946636179387
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:zopVEa862P+vnYUktwwve8xb9NoVUn1oCP3B7sNhnzFSJwZt:zo422m5Dwj4CoCP2NhnzFSJu
                                                                                                                                                                                                                                MD5:A4CDE641D9811CC80C3A89DAEFBAF29A
                                                                                                                                                                                                                                SHA1:52B656C252D30D3F058127F9ECF3383D540BF4C1
                                                                                                                                                                                                                                SHA-256:FC61101AC47E0ED6D8D25DDF38F26D9CE8746DC58E4859CD0429708B444E8BC6
                                                                                                                                                                                                                                SHA-512:CCD50E5F8F794AA6EAF1357C0ED774C38282A214FEB459AE8017C8091322C2E79643BF3A2E6172105C22CDCEA1F26F7511D9361F0B44D9B89213C7DC9F24801C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"type":"main","id":"6240bfcf-dfed-4e23-899e-b04f91c65450","creationDate":"2024-02-21T02:47:34.641Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":8111,"start":4015825,"main":4016941,"selectProfile":4016954,"afterProfileLocked":4016958,"startupCrashDetectionBegin":4021703,"firstPaint":4025277,"firstPaint2":4024607,"sessionRestoreInit":4022251,"sessionRestored":4027061,"createTopLevelWindow":4017665,"blankWindowShown":8037047,"AMI_startup_begin":8037151,"XPI_startup_begin":8037245,"XPI_bootstrap_addons_begin":8037249,"XPI_bootstrap_addons_end":8037305,"XPI_startup_end":8037305,"AMI_startup_end":8037306,"XPI_finalUIStartup":8037595,"sessionRestoreInitialized":8037605,"delayedStartupStarted":8041225,"delayedStartupFinished":8041733,"startupInterrupted

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2024-02\1708483654957.ebdac6c3-343e-4813-9651-969f0566d5e2.health.jsonlz4 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 493 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):446
                                                                                                                                                                                                                                Entropy (8bit):5.577795825110225
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:v05FgRWGLpgZnvMVHkUHW/nBeBlSsoezv91pBR+hAvxn:v/D+BvGkr5eBlxF9HmWvx
                                                                                                                                                                                                                                MD5:98C84C18DEF92248BE2A220F7A565EEB
                                                                                                                                                                                                                                SHA1:F4D6ADA745D4A52A939AF066AA48A5D1BE966331
                                                                                                                                                                                                                                SHA-256:867121815A6E8014981E9415BB71A62BE3B5742216ED5F5E9545977FA5DB9167
                                                                                                                                                                                                                                SHA-512:0BD1D0DC071351F41B5005B4B497413A9338B27226D86F0223BC49F640343A526325D3B9A6FBFF8195779C9545B696D38B0F1CC4E56A531814D3AFA66C5087CF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40......k{"type":"health","id":"ebdac6c3-343e-4813-9651-969f0566d5e2","creationDate":"2024-02-21T02:47:34.957Z","version":4,"applic9...":{"architectur....x86-64","buildI....20230927232528","nam+.xFirefox_..."118.0.1","displayVz......vendor":"Mozilla","platform/...xpcomAbi..._64-msvc....hannel":"release"},"payload.. os.....ZWINNT..00.02.@reas...."immediate","sendFail....{"eUnreachable":1}},"client"...1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2024-02\1708483654957.ebdac6c3-343e-4813-9651-969f0566d5e2.health.jsonlz4.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 493 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):446
                                                                                                                                                                                                                                Entropy (8bit):5.577795825110225
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:v05FgRWGLpgZnvMVHkUHW/nBeBlSsoezv91pBR+hAvxn:v/D+BvGkr5eBlxF9HmWvx
                                                                                                                                                                                                                                MD5:98C84C18DEF92248BE2A220F7A565EEB
                                                                                                                                                                                                                                SHA1:F4D6ADA745D4A52A939AF066AA48A5D1BE966331
                                                                                                                                                                                                                                SHA-256:867121815A6E8014981E9415BB71A62BE3B5742216ED5F5E9545977FA5DB9167
                                                                                                                                                                                                                                SHA-512:0BD1D0DC071351F41B5005B4B497413A9338B27226D86F0223BC49F640343A526325D3B9A6FBFF8195779C9545B696D38B0F1CC4E56A531814D3AFA66C5087CF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40......k{"type":"health","id":"ebdac6c3-343e-4813-9651-969f0566d5e2","creationDate":"2024-02-21T02:47:34.957Z","version":4,"applic9...":{"architectur....x86-64","buildI....20230927232528","nam+.xFirefox_..."118.0.1","displayVz......vendor":"Mozilla","platform/...xpcomAbi..._64-msvc....hannel":"release"},"payload.. os.....ZWINNT..00.02.@reas...."immediate","sendFail....{"eUnreachable":1}},"client"...1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.bin (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13195
                                                                                                                                                                                                                                Entropy (8bit):4.248377139829478
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:Nboc6t1PZ1Jh/hwF3XKWrpbYbrb3bIbzk:tbeeF3XKWrpEbrb3bIbQ
                                                                                                                                                                                                                                MD5:4FC804B63D0CA260574F589CB884C9A0
                                                                                                                                                                                                                                SHA1:4A8C4889ECDB348FFBC83B160ECD352BFF3004FF
                                                                                                                                                                                                                                SHA-256:0AC3648CA279E91A0D2D3CEF0C76B8A8335E4C29CA96C2AAB4033ABE702F6A37
                                                                                                                                                                                                                                SHA-512:265740C7C807BADF6BB6DD6A726DB9755211CEC4884C26A52F689E28A99DB2F6EB433ECA1A1D0D501878DC1263994235F0EF9E4708366929A0C69994A6E1A70B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.................app....5.......>.......background-update#background_update.time_last_update_scheduled6........-...................2024-02-21T02:40:38.953+01:00....#.......baseline#legacy.telemetry.client_id9........0...........$.......1fca7bd2-7b44-4c45-b0ea-e0486850ce95!.......events#legacy.telemetry.client_id9........0...........$.......1fca7bd2-7b44-4c45-b0ea-e0486850ce95........events#urlbar.pref_max_results.............................*.......events#urlbar.pref_suggest_data_collection......................'.......events#urlbar.pref_suggest_nonsponsored......................$.......events#urlbar.pref_suggest_sponsored......................#.......events#urlbar.pref_suggest_topsites..............................glean_client_info#app_build#............................20230927232528........glean_client_info#app_channel.............................release%.......glean_client_info#app_display_version.............................118.0.1........glean_client_info#architecture.............

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13195
                                                                                                                                                                                                                                Entropy (8bit):4.248377139829478
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:Nboc6t1PZ1Jh/hwF3XKWrpbYbrb3bIbzk:tbeeF3XKWrpEbrb3bIbQ
                                                                                                                                                                                                                                MD5:4FC804B63D0CA260574F589CB884C9A0
                                                                                                                                                                                                                                SHA1:4A8C4889ECDB348FFBC83B160ECD352BFF3004FF
                                                                                                                                                                                                                                SHA-256:0AC3648CA279E91A0D2D3CEF0C76B8A8335E4C29CA96C2AAB4033ABE702F6A37
                                                                                                                                                                                                                                SHA-512:265740C7C807BADF6BB6DD6A726DB9755211CEC4884C26A52F689E28A99DB2F6EB433ECA1A1D0D501878DC1263994235F0EF9E4708366929A0C69994A6E1A70B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.................app....5.......>.......background-update#background_update.time_last_update_scheduled6........-...................2024-02-21T02:40:38.953+01:00....#.......baseline#legacy.telemetry.client_id9........0...........$.......1fca7bd2-7b44-4c45-b0ea-e0486850ce95!.......events#legacy.telemetry.client_id9........0...........$.......1fca7bd2-7b44-4c45-b0ea-e0486850ce95........events#urlbar.pref_max_results.............................*.......events#urlbar.pref_suggest_data_collection......................'.......events#urlbar.pref_suggest_nonsponsored......................$.......events#urlbar.pref_suggest_sponsored......................#.......events#urlbar.pref_suggest_topsites..............................glean_client_info#app_build#............................20230927232528........glean_client_info#app_channel.............................release%.......glean_client_info#app_display_version.............................118.0.1........glean_client_info#architecture.............

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1154
                                                                                                                                                                                                                                Entropy (8bit):4.624667299053994
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:YSVMJezDatD7mpD7qtD7qVpDPtm1pDPtqf1l:YwxzecK8HDyDoT
                                                                                                                                                                                                                                MD5:EF7FE5000CD3A92E17F7309FC36F620B
                                                                                                                                                                                                                                SHA1:80F090E310A5EE9E5A4AA35338FCC10F5CB2288C
                                                                                                                                                                                                                                SHA-256:A06E0683556E5DA4350D8DA2ECA2279CC656F8118B4F4CF95D14CA3ED6033CDA
                                                                                                                                                                                                                                SHA-512:7C7B4C75522B1892D453AF02D092BBF22D099A874A4B172620E00BD6BFACC9C17C9A5777412CA5B2D9C5E48A6D057AF3ED6C5313EBF6BCCFDD9423E9796D8E34
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"timestamp":49234,"category":"nimbus_events","name":"enrollment","extra":{"enrollment_id":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","branch":"control","experiment_type":"rollout","experiment":"extensions-migration-in-import-wizard-116-rollout"}}.{"timestamp":63639,"category":"nimbus_events","name":"validation_failed","extra":{"feature":"accessibilityCache","experiment":"next-generation-accessibility-engine-powering-screen-readers","reason":"invalid-feature"}}.{"timestamp":63640,"category":"nimbus_events","name":"validation_failed","extra":{"feature":"accessibilityCache","experiment":"next-generation-accessibility-engine-powering-screen-readers-and-other-ats-copy","reason":"invalid-feature"}}.{"timestamp":72142,"category":"nimbus_events","name":"validation_failed","extra":{"experiment":"next-generation-accessibility-engine-powering-screen-readers","feature":"accessibilityCache","reason":"invalid-feature"}}.{"timestamp":72142,"category":"nimbus_events","name":"validation_failed","extra":{"

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1228
                                                                                                                                                                                                                                Entropy (8bit):4.630986472973819
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:YSgDVMJezDatD7mpD7qtD7qVpDPtm1pDPtqf1l:Yj5xzecK8HDyDoT
                                                                                                                                                                                                                                MD5:720FD44C75BA2FA8150B19D7C6187E11
                                                                                                                                                                                                                                SHA1:6CC44BC87B9ABBFBF81E7169B1F4514814E7828C
                                                                                                                                                                                                                                SHA-256:0B69A0DA393B6CE150B4437C21D77EFD0B79DDDFB0061723546A4CB259C749E3
                                                                                                                                                                                                                                SHA-512:415734574DC2BDD337AC3CF944316EE7FF92452B629E84AABDFFD91947D5C02A2D2EC58EB6719B0F3B941BC3C166B5F473841F145E3650E6C670D882C18C2ECC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"timestamp":0,"category":"fog.validation","name":"validate_early_event"}.{"timestamp":49234,"category":"nimbus_events","name":"enrollment","extra":{"enrollment_id":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","branch":"control","experiment_type":"rollout","experiment":"extensions-migration-in-import-wizard-116-rollout"}}.{"timestamp":63639,"category":"nimbus_events","name":"validation_failed","extra":{"feature":"accessibilityCache","experiment":"next-generation-accessibility-engine-powering-screen-readers","reason":"invalid-feature"}}.{"timestamp":63640,"category":"nimbus_events","name":"validation_failed","extra":{"feature":"accessibilityCache","experiment":"next-generation-accessibility-engine-powering-screen-readers-and-other-ats-copy","reason":"invalid-feature"}}.{"timestamp":72142,"category":"nimbus_events","name":"validation_failed","extra":{"experiment":"next-generation-accessibility-engine-powering-screen-readers","feature":"accessibilityCache","reason":"invalid-feature"}}.{"timesta

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\710e27b4-e4b4-4893-a5fb-fa53d4d68ead (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1345)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1417
                                                                                                                                                                                                                                Entropy (8bit):5.031258287015763
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BGRVhGkQ/u+JjuWLX+RWSj+KfIJgwJ1YUoeAae6iGj9i6oBpBwoB0Mip7v4:dHueuWLuwSaT/YUo/GheBpbB0LpL4
                                                                                                                                                                                                                                MD5:2010834B596F8E589CCF45189AD37D25
                                                                                                                                                                                                                                SHA1:55A558625B213F1D41305799DEB4D90EF0CC8023
                                                                                                                                                                                                                                SHA-256:3C285DFE69E9CD5E33371302EBF8FD0DE215878C71630E1DE1C43819A4455C67
                                                                                                                                                                                                                                SHA-512:C03A4F2BC2B11087920480C85E78DA363EFB933C7B656D28D87E5025FF40B424AA5793E0B1259DF1D6514E4FEE83662C27C42DBA55090F96ADF26E659A24B333
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/baseline/1/710e27b4-e4b4-4893-a5fb-fa53d4d68ead.{"ping_info":{"seq":2,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","reason":"active","experiments":{"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","architecture":"x86_64","os":"Windows","app_display_version":"118.0.1","locale":"en-US","app_channel":"release","os_version":"10.0","app_build":"20230927232528","clie

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\76442bb8-a72d-4eac-8de6-3784232ce828 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1394)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1474
                                                                                                                                                                                                                                Entropy (8bit):5.110992884102201
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BG1cz/oWLX+RWSj+KfL+Jj3Jgw+0kUku/jlMsAaUdNQK+7qOaSYKLjNF9mPb+pAS:SAoWLuwSaqe5O0kUkyebQv7qOaj+ZmPm
                                                                                                                                                                                                                                MD5:16ABDE69B738A08145FCA0879F189E5C
                                                                                                                                                                                                                                SHA1:969AC7F642D71E26EDEA50F8F30AA9267A97B8AD
                                                                                                                                                                                                                                SHA-256:C51DA25649ACE3AC4AF7D74F1EC6721A3F054020454D44F8B8AAC8B4A539F05D
                                                                                                                                                                                                                                SHA-512:12E2A4C7ABEFE1F515896D5C34873CFBA4E421B9C2EE56E5C18F25C760BD4D2EECF7EFD6D02C5FA676D8B71677F235F81EE6B5EAE6A50D69258674501EE79403
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/76442bb8-a72d-4eac-8de6-3784232ce828.{"ping_info":{"seq":9,"start_time":"2024-02-21T03:47+01:00","end_time":"2024-02-21T03:47+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","windows_build_number":19045,"first_run_date":"2023-10-04+01:00","build_date":"1970-01-01T00:00:00+00:00","app_build":"20230927232528","locale":"en-US","app_channel":"release",

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\a094d67e-eb81-47e3-abe4-26c9be1bf947 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (872)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):942
                                                                                                                                                                                                                                Entropy (8bit):4.972006700162402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BGOZlNvU+Gi5GjMsAU0BpBnGAh50ZLJPrla:LzUH/0PBpYAIPc
                                                                                                                                                                                                                                MD5:E0C01F225ECCF6C8B2403E06FA79E330
                                                                                                                                                                                                                                SHA1:5E062FDB0B9D80CB520373851B657F5ED3BCBE56
                                                                                                                                                                                                                                SHA-256:3F90074BCBE27D82C1E1C31D960A3B2E92904EAE6DB23DF3BDD406E834151AE8
                                                                                                                                                                                                                                SHA-512:8582B7415500D4E10048FD51548D232F2368F82F337816BE997CB06982DBAF91C6525C298084B03E396AE91C2DDB72D821EF99C9B797B8A9837DB3C0B4D05FC7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/newtab/1/a094d67e-eb81-47e3-abe4-26c9be1bf947.{"ping_info":{"seq":6,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"d6eabfd9-e659-41c7-a9da-1a0be7949be6","locale":"en-US","os":"Windows","os_version":"10.0","app_build":"20230927232528","app_channel":"release","architecture":"x86_64","app_display_version":"118.0.1","first_run_date":"2023-10-04+01:00","build_date":"1970-01-01T00:00:00+00:00","windows_build_number":19045},"metrics":{"boolean":{"pocket.sponsored_stories_enabled":true,"topsites.sponsored_enabled":true,"newtab.search.enabled":true,"topsites.enabled":true,"pocket.is_signed_in":false,"pocket.enabled":true},"string_list":{"newtab.blocked_sponsors":[]},"string":{"newtab.locale":"en-US","newtab.newtab_category":"enabled","newtab.homepage_category":"enabled"},"quantity":{"topsites.rows":1}}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\c8000ec7-1f0c-450c-9ad2-ba85817e551a (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1376)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1456
                                                                                                                                                                                                                                Entropy (8bit):5.088036158363416
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BG/0/oWLXJiWSjJnfL+Jj3Jgw+0kUojRdMoAabu6G7+pAkQ+KePYaSYjNF9KBd:3oWLPSVe5O0kUoGsZEoAkQ+/YajZcd
                                                                                                                                                                                                                                MD5:B947D31681630E63884D6C8E9A3EE00E
                                                                                                                                                                                                                                SHA1:D77F17FDDB973C965F466A74578F4ED0C76EE181
                                                                                                                                                                                                                                SHA-256:92479231CFDFFD70ED890C66973E25009ED0D1BA4E7B51B95D5CAEAB4ABA487C
                                                                                                                                                                                                                                SHA-512:AAF644BD519FC6943CCAF71668540DBDCDD77234EA84BF8B39DB99390E5C0D36592A21A2E81CDC11D11D199578E05F05523C7E4AD7383EA0456D54299861B780
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/c8000ec7-1f0c-450c-9ad2-ba85817e551a.{"ping_info":{"seq":8,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652","type":"nimbus-rollout"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","app_build":"20230927232528","os_version":"10.0","app_display_version":"118.0.1","app_channel":"release","locale":"en-US","architecture":"x86_64","os":"Windows","windows_build_

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\cfdff801-4627-4637-a4cb-90c01f011cbe (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1759)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1829
                                                                                                                                                                                                                                Entropy (8bit):4.9641417305786275
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BGBhYY2vV/oWLXJjJgw+06RWSj+KfxU9CGi5GjMsAUmBpuXp3Itp7vokwTtD71OJ:IhEoWLHO0zSasU9T/03BpEcpLUVI
                                                                                                                                                                                                                                MD5:B954C6C253396C609A81224A7C191036
                                                                                                                                                                                                                                SHA1:C43628AECAEC5725DCBDFAD158A685846DDCA121
                                                                                                                                                                                                                                SHA-256:0B27AE0AFE01180A60FA264236B90F75E53C45309A3FE432DC425C9558B3FFF0
                                                                                                                                                                                                                                SHA-512:B17C7438FE73952B85322ADDDEEC9E044D721130DED66EA5AE2A788930A4DA5BE0B443079FE2BD11B54D6635B65D20656BAC9A3BEEF24F04A5B65DB606C85F13
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/events/1/cfdff801-4627-4637-a4cb-90c01f011cbe.{"ping_info":{"seq":1,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","reason":"startup","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","first_run_date":"2023-10-04+01:00","build_date":"1970-01-01T00:00:00+00:00","client_id":"d6eabfd9-e659-41c7-a9da-1a0be7949be6","locale":"en-US","os":"Windows","os_version":"10.0","app_build":"20230927232528","app_channel":"release","architecture":"x86_64","app_display_version":"118.0.1","windows_build_number":19045},"metrics"

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\710e27b4-e4b4-4893-a5fb-fa53d4d68ead

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1345)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1417
                                                                                                                                                                                                                                Entropy (8bit):5.031258287015763
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BGRVhGkQ/u+JjuWLX+RWSj+KfIJgwJ1YUoeAae6iGj9i6oBpBwoB0Mip7v4:dHueuWLuwSaT/YUo/GheBpbB0LpL4
                                                                                                                                                                                                                                MD5:2010834B596F8E589CCF45189AD37D25
                                                                                                                                                                                                                                SHA1:55A558625B213F1D41305799DEB4D90EF0CC8023
                                                                                                                                                                                                                                SHA-256:3C285DFE69E9CD5E33371302EBF8FD0DE215878C71630E1DE1C43819A4455C67
                                                                                                                                                                                                                                SHA-512:C03A4F2BC2B11087920480C85E78DA363EFB933C7B656D28D87E5025FF40B424AA5793E0B1259DF1D6514E4FEE83662C27C42DBA55090F96ADF26E659A24B333
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/baseline/1/710e27b4-e4b4-4893-a5fb-fa53d4d68ead.{"ping_info":{"seq":2,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","reason":"active","experiments":{"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","architecture":"x86_64","os":"Windows","app_display_version":"118.0.1","locale":"en-US","app_channel":"release","os_version":"10.0","app_build":"20230927232528","clie

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\76442bb8-a72d-4eac-8de6-3784232ce828

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1394)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1474
                                                                                                                                                                                                                                Entropy (8bit):5.110992884102201
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BG1cz/oWLX+RWSj+KfL+Jj3Jgw+0kUku/jlMsAaUdNQK+7qOaSYKLjNF9mPb+pAS:SAoWLuwSaqe5O0kUkyebQv7qOaj+ZmPm
                                                                                                                                                                                                                                MD5:16ABDE69B738A08145FCA0879F189E5C
                                                                                                                                                                                                                                SHA1:969AC7F642D71E26EDEA50F8F30AA9267A97B8AD
                                                                                                                                                                                                                                SHA-256:C51DA25649ACE3AC4AF7D74F1EC6721A3F054020454D44F8B8AAC8B4A539F05D
                                                                                                                                                                                                                                SHA-512:12E2A4C7ABEFE1F515896D5C34873CFBA4E421B9C2EE56E5C18F25C760BD4D2EECF7EFD6D02C5FA676D8B71677F235F81EE6B5EAE6A50D69258674501EE79403
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/76442bb8-a72d-4eac-8de6-3784232ce828.{"ping_info":{"seq":9,"start_time":"2024-02-21T03:47+01:00","end_time":"2024-02-21T03:47+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","windows_build_number":19045,"first_run_date":"2023-10-04+01:00","build_date":"1970-01-01T00:00:00+00:00","app_build":"20230927232528","locale":"en-US","app_channel":"release",

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\a094d67e-eb81-47e3-abe4-26c9be1bf947

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (872)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):942
                                                                                                                                                                                                                                Entropy (8bit):4.972006700162402
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BGOZlNvU+Gi5GjMsAU0BpBnGAh50ZLJPrla:LzUH/0PBpYAIPc
                                                                                                                                                                                                                                MD5:E0C01F225ECCF6C8B2403E06FA79E330
                                                                                                                                                                                                                                SHA1:5E062FDB0B9D80CB520373851B657F5ED3BCBE56
                                                                                                                                                                                                                                SHA-256:3F90074BCBE27D82C1E1C31D960A3B2E92904EAE6DB23DF3BDD406E834151AE8
                                                                                                                                                                                                                                SHA-512:8582B7415500D4E10048FD51548D232F2368F82F337816BE997CB06982DBAF91C6525C298084B03E396AE91C2DDB72D821EF99C9B797B8A9837DB3C0B4D05FC7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/newtab/1/a094d67e-eb81-47e3-abe4-26c9be1bf947.{"ping_info":{"seq":6,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"d6eabfd9-e659-41c7-a9da-1a0be7949be6","locale":"en-US","os":"Windows","os_version":"10.0","app_build":"20230927232528","app_channel":"release","architecture":"x86_64","app_display_version":"118.0.1","first_run_date":"2023-10-04+01:00","build_date":"1970-01-01T00:00:00+00:00","windows_build_number":19045},"metrics":{"boolean":{"pocket.sponsored_stories_enabled":true,"topsites.sponsored_enabled":true,"newtab.search.enabled":true,"topsites.enabled":true,"pocket.is_signed_in":false,"pocket.enabled":true},"string_list":{"newtab.blocked_sponsors":[]},"string":{"newtab.locale":"en-US","newtab.newtab_category":"enabled","newtab.homepage_category":"enabled"},"quantity":{"topsites.rows":1}}}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\c8000ec7-1f0c-450c-9ad2-ba85817e551a

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1376)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1456
                                                                                                                                                                                                                                Entropy (8bit):5.088036158363416
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BG/0/oWLXJiWSjJnfL+Jj3Jgw+0kUojRdMoAabu6G7+pAkQ+KePYaSYjNF9KBd:3oWLPSVe5O0kUoGsZEoAkQ+/YajZcd
                                                                                                                                                                                                                                MD5:B947D31681630E63884D6C8E9A3EE00E
                                                                                                                                                                                                                                SHA1:D77F17FDDB973C965F466A74578F4ED0C76EE181
                                                                                                                                                                                                                                SHA-256:92479231CFDFFD70ED890C66973E25009ED0D1BA4E7B51B95D5CAEAB4ABA487C
                                                                                                                                                                                                                                SHA-512:AAF644BD519FC6943CCAF71668540DBDCDD77234EA84BF8B39DB99390E5C0D36592A21A2E81CDC11D11D199578E05F05523C7E4AD7383EA0456D54299861B780
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/messaging-system/1/c8000ec7-1f0c-450c-9ad2-ba85817e551a.{"ping_info":{"seq":8,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652","type":"nimbus-rollout"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"f13eff29-4624-4b3f-9a5e-2889c3bddc34","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","app_build":"20230927232528","os_version":"10.0","app_display_version":"118.0.1","app_channel":"release","locale":"en-US","architecture":"x86_64","os":"Windows","windows_build_

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\cfdff801-4627-4637-a4cb-90c01f011cbe

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1759)
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1829
                                                                                                                                                                                                                                Entropy (8bit):4.9641417305786275
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:BGBhYY2vV/oWLXJjJgw+06RWSj+KfxU9CGi5GjMsAUmBpuXp3Itp7vokwTtD71OJ:IhEoWLHO0zSasU9T/03BpEcpLUVI
                                                                                                                                                                                                                                MD5:B954C6C253396C609A81224A7C191036
                                                                                                                                                                                                                                SHA1:C43628AECAEC5725DCBDFAD158A685846DDCA121
                                                                                                                                                                                                                                SHA-256:0B27AE0AFE01180A60FA264236B90F75E53C45309A3FE432DC425C9558B3FFF0
                                                                                                                                                                                                                                SHA-512:B17C7438FE73952B85322ADDDEEC9E044D721130DED66EA5AE2A788930A4DA5BE0B443079FE2BD11B54D6635B65D20656BAC9A3BEEF24F04A5B65DB606C85F13
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:/submit/firefox-desktop/events/1/cfdff801-4627-4637-a4cb-90c01f011cbe.{"ping_info":{"seq":1,"start_time":"2023-10-04T14:40+01:00","end_time":"2024-02-21T03:47+01:00","reason":"startup","experiments":{"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"4fb599b7-2bfe-40fa-aec3-5b51dcdef652","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"3eec18fa-2067-4082-925e-9c8a7241148b"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","first_run_date":"2023-10-04+01:00","build_date":"1970-01-01T00:00:00+00:00","client_id":"d6eabfd9-e659-41c7-a9da-1a0be7949be6","locale":"en-US","os":"Windows","os_version":"10.0","app_build":"20230927232528","app_channel":"release","architecture":"x86_64","app_display_version":"118.0.1","windows_build_number":19045},"metrics"

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):161
                                                                                                                                                                                                                                Entropy (8bit):4.856122445341522
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YWAqKsORJI/0dWQRMf/t6fWIEd8jPQ7xJA2aqnLJrja/H5C:YWAqfGIqWQqf/FIEoo7xOanLFu/ZC
                                                                                                                                                                                                                                MD5:20006220C5C004038F047859A73FAC44
                                                                                                                                                                                                                                SHA1:A3E8E5ADDDBE7A52A541698394DAA3FD474D4F17
                                                                                                                                                                                                                                SHA-256:BAEA8D9362A7A0D2BFB6D3D6A0C0FAE85E3EAD791AE1DFC6D6E10F3C3948BAA1
                                                                                                                                                                                                                                SHA-512:6E1ADB3E68267F78C6ADA1ED761F2D10FDB6DE59DD1908014402701DFCD0A9446A28EECC4D587957712C0DF4F0F90C6C72A5F71F778F81F12D1679055066AF1D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"sessionId":"16159c64-b0ba-4e1a-b579-619c6b856b69","subsessionId":"b26f3705-b12b-4914-a86b-dc3516055595","profileSubsessionCounter":3,"newProfilePingSent":true}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):36830
                                                                                                                                                                                                                                Entropy (8bit):5.1867463390487
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                                                                                                                                                                                                MD5:98875950B62B398FFE70C0A8D0998017
                                                                                                                                                                                                                                SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                                                                                                                                                                                                SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                                                                                                                                                                                                SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):36830
                                                                                                                                                                                                                                Entropy (8bit):5.1867463390487
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                                                                                                                                                                                                MD5:98875950B62B398FFE70C0A8D0998017
                                                                                                                                                                                                                                SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                                                                                                                                                                                                SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                                                                                                                                                                                                SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1021904
                                                                                                                                                                                                                                Entropy (8bit):6.648417932394748
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                                                                                MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                                                                                SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                                                                                SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                                                                                SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):1021904
                                                                                                                                                                                                                                Entropy (8bit):6.648417932394748
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                                                                                MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                                                                                SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                                                                                SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                                                                                SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                                                                                Malicious:true
                                                                                                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                Entropy (8bit):4.968220104601006
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                                                                                MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                                                                                SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                                                                                SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                                                                                SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):116
                                                                                                                                                                                                                                Entropy (8bit):4.968220104601006
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                                                                                MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                                                                                SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                                                                                SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                                                                                SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.035822017202226504
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:GtlstFPDRXcA/NjHoylstFPDRXcA/NjHoXL89//alEl:GtWtTcA/xzWtTcA/xW89XuM
                                                                                                                                                                                                                                MD5:135F34979B493C9B87D37E6696F23386
                                                                                                                                                                                                                                SHA1:1D54F222F6E500BA77AD5093CB543EDC64CD397C
                                                                                                                                                                                                                                SHA-256:41A22AF6280680270DD72146893D5C87B21ED995BF9079B98D456C05818C545B
                                                                                                                                                                                                                                SHA-512:153548B6B24BE7158CBA45EE4AB392AC827DDAB7F23D86481A22738D385DB83BD4B0E335C941E2EBE1BE74509FAF56DA867665A3A62187148DEA40BED8B48BB2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-......................$Y....5.7y.%..B..W....-......................$Y....5.7y.%..B..W..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32824
                                                                                                                                                                                                                                Entropy (8bit):0.03976733009585793
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:Ol1NSfzYg3Qman8spWvllrl8rEXsxdwhml8XW3R2:K2sgo8spollrl8dMhm93w
                                                                                                                                                                                                                                MD5:C8669CDCBE3B2BC4C1FE29A4E51E6740
                                                                                                                                                                                                                                SHA1:5E01D4BE7154D704E4B2C1F39087320F6EAAD0B5
                                                                                                                                                                                                                                SHA-256:7E7DBE47DCE3811F6110F235980676D12F90B546BC963BFD81152DE8CA5B1CC2
                                                                                                                                                                                                                                SHA-512:F115AD00FD762278BE87FE8691D2D4A8704F79E11427ACAA142C6469BE2254248F775074FA51BA8E8F669E405DD0711FF9B5928046AB6A0D5DFEAE557970AA6A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:7....-..........5.7y.%..N..H5p.o........5.7y.%...Y$....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):13178
                                                                                                                                                                                                                                Entropy (8bit):5.4772779499958
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:lnPOeRnLYbBp6ZJ0aX+E6SEXKUqNZg5RHWNBw8dfdSl:xDekJUnJmeHEwqd0
                                                                                                                                                                                                                                MD5:9E1CEA6DE130873A6E051545E74CE572
                                                                                                                                                                                                                                SHA1:10D0818EB6E251C03FE3BFCABCC04716C4E8E5CD
                                                                                                                                                                                                                                SHA-256:11D22572186A98242E9CF14BFFFF11743E2D6391CFD9B870B8F095F41650BAFC
                                                                                                                                                                                                                                SHA-512:DCA06963BEF62EE23F73CB1C2FD51019CA921EC5C94591A0CFF3F4A0F8BD630C7FD41197C1580B59A46D9433DB5936DB891D2BBD6D544D69F5F0B512CFED1C2D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1708483618);..user_pref("app.update.lastUpdateTime.background-update-timer", 1708483618);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1708483618);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 169642

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):13178
                                                                                                                                                                                                                                Entropy (8bit):5.4772779499958
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:lnPOeRnLYbBp6ZJ0aX+E6SEXKUqNZg5RHWNBw8dfdSl:xDekJUnJmeHEwqd0
                                                                                                                                                                                                                                MD5:9E1CEA6DE130873A6E051545E74CE572
                                                                                                                                                                                                                                SHA1:10D0818EB6E251C03FE3BFCABCC04716C4E8E5CD
                                                                                                                                                                                                                                SHA-256:11D22572186A98242E9CF14BFFFF11743E2D6391CFD9B870B8F095F41650BAFC
                                                                                                                                                                                                                                SHA-512:DCA06963BEF62EE23F73CB1C2FD51019CA921EC5C94591A0CFF3F4A0F8BD630C7FD41197C1580B59A46D9433DB5936DB891D2BBD6D544D69F5F0B512CFED1C2D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1708483618);..user_pref("app.update.lastUpdateTime.background-update-timer", 1708483618);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1708483618);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 169642

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):65536
                                                                                                                                                                                                                                Entropy (8bit):0.04062825861060003
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
                                                                                                                                                                                                                                MD5:60C09456D6362C6FBED48C69AA342C3C
                                                                                                                                                                                                                                SHA1:58B6E22DAA48C75958B429F662DEC1C011AE74D3
                                                                                                                                                                                                                                SHA-256:FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
                                                                                                                                                                                                                                SHA-512:936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite-journal

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):33288
                                                                                                                                                                                                                                Entropy (8bit):0.08329919213488089
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:7+/lfgtBl/lquN1P4BEJYqWvLue3FMOrMZ008v:7+tf6Bl/ZnjfJiFxMZav
                                                                                                                                                                                                                                MD5:E91113EB325987BAD14B47F0371EF430
                                                                                                                                                                                                                                SHA1:AD9B60D1558744DF34C492AAEFD3E20F0530DA41
                                                                                                                                                                                                                                SHA-256:5424B5C1AE9C7B6844200FEA1268041093848AD2A0AD363087AAA8F553586985
                                                                                                                                                                                                                                SHA-512:CCD3425DC6729CE04A97F95D2F47471321B179F0EFB33B28949E4D9DE03BF782E367C00B5E44EFDF629803B7C76DF0B184E3110A537836FA3787609CC0CCCE1C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.... .c............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.......x..x......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\ebdac6c3-343e-4813-9651-969f0566d5e2 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):493
                                                                                                                                                                                                                                Entropy (8bit):4.9691411594028905
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:YZFgRWGLpgZnvIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YGD+BvSlCOlZGV1AQIWZcy6ZXvx
                                                                                                                                                                                                                                MD5:642DCAC57FFDC96BBD2ADBEBEC5247E3
                                                                                                                                                                                                                                SHA1:2E7EB117BEA466A5BAE30869A9DA73E97EAEAD7B
                                                                                                                                                                                                                                SHA-256:967EF002BDBCF32994C6F1FF5157E1CF02F68A804AE9609043B9ACB72D1097A6
                                                                                                                                                                                                                                SHA-512:ED4D19762B915F3ED41AC471630B9E40BB3A6F4D1C6FABE945FB8FFF4F6197AD7E3E0340E218E5399D132D76A75E2B2C594D60F7FCE5FEF662D4368714E834FB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"type":"health","id":"ebdac6c3-343e-4813-9651-969f0566d5e2","creationDate":"2024-02-21T02:47:34.957Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\ebdac6c3-343e-4813-9651-969f0566d5e2.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):493
                                                                                                                                                                                                                                Entropy (8bit):4.9691411594028905
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:YZFgRWGLpgZnvIVHlW8cOlZGV1AQIYzvZcyBuLZGAvxn:YGD+BvSlCOlZGV1AQIWZcy6ZXvx
                                                                                                                                                                                                                                MD5:642DCAC57FFDC96BBD2ADBEBEC5247E3
                                                                                                                                                                                                                                SHA1:2E7EB117BEA466A5BAE30869A9DA73E97EAEAD7B
                                                                                                                                                                                                                                SHA-256:967EF002BDBCF32994C6F1FF5157E1CF02F68A804AE9609043B9ACB72D1097A6
                                                                                                                                                                                                                                SHA-512:ED4D19762B915F3ED41AC471630B9E40BB3A6F4D1C6FABE945FB8FFF4F6197AD7E3E0340E218E5399D132D76A75E2B2C594D60F7FCE5FEF662D4368714E834FB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"type":"health","id":"ebdac6c3-343e-4813-9651-969f0566d5e2","creationDate":"2024-02-21T02:47:34.957Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"os":{"name":"WINNT","version":"10.0"},"reason":"immediate","sendFailure":{"eUnreachable":1}},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95"}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):90
                                                                                                                                                                                                                                Entropy (8bit):4.194538242412464
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                                                MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                                                SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                                                SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                                                SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):90
                                                                                                                                                                                                                                Entropy (8bit):4.194538242412464
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                                                MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                                                SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                                                SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                                                SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.baklz4 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 11891 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2480
                                                                                                                                                                                                                                Entropy (8bit):6.465671391426052
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:RprfK3/eUGvATf+MKE+BCPZc9rA3Xjh/cUXtMW8rizgsGAX6lbqB3HcZBtg:3ivjf+MSCBv3X1c2MWIpBe3HF
                                                                                                                                                                                                                                MD5:F64542143649BB583391DFF69028AD31
                                                                                                                                                                                                                                SHA1:F1C0A1042DA163C3035B9B263E6F0EEAE058C6BD
                                                                                                                                                                                                                                SHA-256:1A111AC3EF4017A71A83E70A768F286EB5F2BAB43CE81C2FE2D496F4B2ABB702
                                                                                                                                                                                                                                SHA-512:C2B1E68A2848D154D2D47491141BE299724E6E335E3D898A259B20FBE24457E39F2B7E46F59A82BBD96961BBB0B7A5F0259289CEBF660AF0E7E4BE0EFAFD6C58
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40.s.....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/","title#....cacheKey":0,"ID":7,"docshellUU...D"{a48fd009-1f1d-4f26-a65e-d51db177c65d}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1708483585924,"hiddey..searchMode...userContextId...attributq..{},"index":1...questedI..s0,"imagL./},....accounts.googl....'......8.......94c0ffe7-e6c0-459c-8590-3f4d5c3943c7S...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==..^.9...O6142..Z.T..TypedValu..........0..Clear":1K......facebook.._video....)...O..9O...83e57a47-44e0-4b76-9fe0-3e3cf09d1c5aO../10P..o604045P.Z.......0.22....012bc45b-b739-4607-92b1-d394f953ee13....,..Z..o629533..Z."..R........N.o.23M...8b8b6904-5379-49f1-903f-3eb1ce4e59dM...5M.._12908M.V.."chrome://global/skin/icons/warning.svg"s.......y..'...|..{..~...73e92d4b-248f-45c8-85c1-ab999f22cf64{...6...O5351..W...3.....*..#...&..

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 11891 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2480
                                                                                                                                                                                                                                Entropy (8bit):6.465671391426052
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:RprfK3/eUGvATf+MKE+BCPZc9rA3Xjh/cUXtMW8rizgsGAX6lbqB3HcZBtg:3ivjf+MSCBv3X1c2MWIpBe3HF
                                                                                                                                                                                                                                MD5:F64542143649BB583391DFF69028AD31
                                                                                                                                                                                                                                SHA1:F1C0A1042DA163C3035B9B263E6F0EEAE058C6BD
                                                                                                                                                                                                                                SHA-256:1A111AC3EF4017A71A83E70A768F286EB5F2BAB43CE81C2FE2D496F4B2ABB702
                                                                                                                                                                                                                                SHA-512:C2B1E68A2848D154D2D47491141BE299724E6E335E3D898A259B20FBE24457E39F2B7E46F59A82BBD96961BBB0B7A5F0259289CEBF660AF0E7E4BE0EFAFD6C58
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40.s.....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/","title#....cacheKey":0,"ID":7,"docshellUU...D"{a48fd009-1f1d-4f26-a65e-d51db177c65d}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1708483585924,"hiddey..searchMode...userContextId...attributq..{},"index":1...questedI..s0,"imagL./},....accounts.googl....'......8.......94c0ffe7-e6c0-459c-8590-3f4d5c3943c7S...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==..^.9...O6142..Z.T..TypedValu..........0..Clear":1K......facebook.._video....)...O..9O...83e57a47-44e0-4b76-9fe0-3e3cf09d1c5aO../10P..o604045P.Z.......0.22....012bc45b-b739-4607-92b1-d394f953ee13....,..Z..o629533..Z."..R........N.o.23M...8b8b6904-5379-49f1-903f-3eb1ce4e59dM...5M.._12908M.V.."chrome://global/skin/icons/warning.svg"s.......y..'...|..{..~...73e92d4b-248f-45c8-85c1-ab999f22cf64{...6...O5351..W...3.....*..#...&..

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:Mozilla lz4 compressed data, originally 11891 bytes
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2480
                                                                                                                                                                                                                                Entropy (8bit):6.465671391426052
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:RprfK3/eUGvATf+MKE+BCPZc9rA3Xjh/cUXtMW8rizgsGAX6lbqB3HcZBtg:3ivjf+MSCBv3X1c2MWIpBe3HF
                                                                                                                                                                                                                                MD5:F64542143649BB583391DFF69028AD31
                                                                                                                                                                                                                                SHA1:F1C0A1042DA163C3035B9B263E6F0EEAE058C6BD
                                                                                                                                                                                                                                SHA-256:1A111AC3EF4017A71A83E70A768F286EB5F2BAB43CE81C2FE2D496F4B2ABB702
                                                                                                                                                                                                                                SHA-512:C2B1E68A2848D154D2D47491141BE299724E6E335E3D898A259B20FBE24457E39F2B7E46F59A82BBD96961BBB0B7A5F0259289CEBF660AF0E7E4BE0EFAFD6C58
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:mozLz40.s.....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://www.youtube.com/","title#....cacheKey":0,"ID":7,"docshellUU...D"{a48fd009-1f1d-4f26-a65e-d51db177c65d}","resultPrincipalURI":null,"hasUserInteract....false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1708483585924,"hiddey..searchMode...userContextId...attributq..{},"index":1...questedI..s0,"imagL./},....accounts.googl....'......8.......94c0ffe7-e6c0-459c-8590-3f4d5c3943c7S...referrerInfo":"BBoSnxDOS9qmDeAnom1e0A...w..$EY.....0BAQ..oABAA==..^.9...O6142..Z.T..TypedValu..........0..Clear":1K......facebook.._video....)...O..9O...83e57a47-44e0-4b76-9fe0-3e3cf09d1c5aO../10P..o604045P.Z.......0.22....012bc45b-b739-4607-92b1-d394f953ee13....,..Z..o629533..Z."..R........N.o.23M...8b8b6904-5379-49f1-903f-3eb1ce4e59dM...5M.._12908M.V.."chrome://global/skin/icons/warning.svg"s.......y..'...|..{..~...73e92d4b-248f-45c8-85c1-ab999f22cf64{...6...O5351..W...3.....*..#...&..

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4096
                                                                                                                                                                                                                                Entropy (8bit):2.0836444556178684
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
                                                                                                                                                                                                                                MD5:8B40B1534FF0F4B533AF767EB5639A05
                                                                                                                                                                                                                                SHA1:63EDB539EA39AD09D701A36B535C4C087AE08CC9
                                                                                                                                                                                                                                SHA-256:AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
                                                                                                                                                                                                                                SHA-512:54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite-journal

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:SQLite Rollback Journal
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):2592
                                                                                                                                                                                                                                Entropy (8bit):0.45477758480466574
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:7FEG2l79X9dlp/FlfTX/lffWkJtnkt1Hl/QMRgSEBtl/g/vVltllkNhXXPtc:7+/l7p/1ctfgvBtl4/cHPtc
                                                                                                                                                                                                                                MD5:6CD8F262E454791D27EB5A17CC087FEA
                                                                                                                                                                                                                                SHA1:EFAC1F01F43CA0AC63417F747604CE1941FFED2B
                                                                                                                                                                                                                                SHA-256:C4DDEC236F11261C794568AFDF61F6246FED580C695FB662D74133A1F04FFEDB
                                                                                                                                                                                                                                SHA-512:57D3098B80872DF94BE3F5E6E4BB080E4A11C4ECEFCD9696F6EECE2E0043FC604FD3F06A8942C2A62F401F487CD6E68F293219D394B8F3F4CEC96B5BE3726ED7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.... .c......4.8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.0204403089568655
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lX5d/5Y8lX5d/T/lXR9//:G0Dy0DLr9X
                                                                                                                                                                                                                                MD5:D966AE0E9871F73A54C4F4968561F15B
                                                                                                                                                                                                                                SHA1:FFF4D77298B2EC4DB3D6EC6838F96A5E5D25FF60
                                                                                                                                                                                                                                SHA-256:AF4782DEBC83205B4523C0F10E7802D2CE232D9C1511C4F74FA5B0C62D162FDF
                                                                                                                                                                                                                                SHA-512:3860AF39A4FF7D8995EA8C3BFD9E6D081507EFBCC078DA6290F8602554605148A98502E56A24075F90842F73F07D8E72C7DA5B8BED47477DA85331E2D0128AAB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8....g...-.....................................8....g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):32768
                                                                                                                                                                                                                                Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json (copy)

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4537
                                                                                                                                                                                                                                Entropy (8bit):5.030322079177386
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:ycmMTEr5/lLmI2Ac1zzcxvbw6Kkyrc2Rn27:9TEr5NX0z3xhRe
                                                                                                                                                                                                                                MD5:78BBC7E7291CCF6A44A674E517BB00E3
                                                                                                                                                                                                                                SHA1:AD4A64B54B8FE4AA73B4C472215A852D0AA217E6
                                                                                                                                                                                                                                SHA-256:DCEF3754CD4EC0FC41D753758F1D44C01118A8494AA5D615547BEED402EC2866
                                                                                                                                                                                                                                SHA-512:E61FB4009FFBB7F411BE0F4E8F8034564B644D2C56E8728CF60D79699ABE18CF79421E628A8D4D3EB67B967544B11D68F7D4EF4FA5F5054588AC661DC81145D0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-02-21T02:47:35.885Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                                                                                                                                                                C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):4537
                                                                                                                                                                                                                                Entropy (8bit):5.030322079177386
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:ycmMTEr5/lLmI2Ac1zzcxvbw6Kkyrc2Rn27:9TEr5NX0z3xhRe
                                                                                                                                                                                                                                MD5:78BBC7E7291CCF6A44A674E517BB00E3
                                                                                                                                                                                                                                SHA1:AD4A64B54B8FE4AA73B4C472215A852D0AA217E6
                                                                                                                                                                                                                                SHA-256:DCEF3754CD4EC0FC41D753758F1D44C01118A8494AA5D615547BEED402EC2866
                                                                                                                                                                                                                                SHA-512:E61FB4009FFBB7F411BE0F4E8F8034564B644D2C56E8728CF60D79699ABE18CF79421E628A8D4D3EB67B967544B11D68F7D4EF4FA5F5054588AC661DC81145D0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-02-21T02:47:35.885Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                                                                                                                                                                C:\Windows\Logs\SIH\SIH.20240221.023908.294.1.etl

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):12288
                                                                                                                                                                                                                                Entropy (8bit):2.9623429252027407
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:Fc0Eg0SzQ5IT/YvThDKJadyY7bPFEE29P:Fc090Sz4IT/YvThDKJOyY77FEE29P
                                                                                                                                                                                                                                MD5:325AC17A964EF5E9464D7A4D4690B96A
                                                                                                                                                                                                                                SHA1:6D718D41910041BEB3C8489FA9E1BFFB8355A706
                                                                                                                                                                                                                                SHA-256:A18DE3DDD6999042940FDAF4CDE174663F85E4750B8B97C55A94ADFCD5F9EF98
                                                                                                                                                                                                                                SHA-512:5AF9DB87DB56229AE5601BF1644F1837A06C3C28445E9839652B0AC1F2D58D00B68A6765CC27CA6250922ABFB18DC728ED679C4C44C41233C99FDBBEBE62EFED
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:....P...P.......................................P...!...........................................................eJ.......:..fd..Zb....... ..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................W...............~..fd..........S.I.H._.t.r.a.c.e._.l.o.g...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.S.I.H.\.S.I.H...2.0.2.4.0.2.2.1...0.2.3.9.0.8...2.9.4...1...e.t.l.......P.P.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP9A83.tmp

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                                                                                File Type:Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                                                                                                                                                Category:modified
                                                                                                                                                                                                                                Size (bytes):17126
                                                                                                                                                                                                                                Entropy (8bit):7.3117215578334935
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
                                                                                                                                                                                                                                MD5:1B6460EE0273E97C251F7A67F49ACDB4
                                                                                                                                                                                                                                SHA1:4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
                                                                                                                                                                                                                                SHA-256:3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
                                                                                                                                                                                                                                SHA-512:3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MSCF............D................|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM...*......z.;......t.<.o..|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A...*.H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0...*.H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...*

                                                                                                                                                                                                                                C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                                                                                File Type:Microsoft Cabinet archive data, single, 7826 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 53283, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):24490
                                                                                                                                                                                                                                Entropy (8bit):7.629144636744632
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:iarwQcY8StpA7IQ6GCq30XPSIleI7lzCuqvfiSIleIx:iartHA7PCFP66Tqvfi6c
                                                                                                                                                                                                                                MD5:ACD24F781C0C8F48A0BD86A0E9F2A154
                                                                                                                                                                                                                                SHA1:93B2F4FBF96D15BE0766181AFACDB9FD9DD1B323
                                                                                                                                                                                                                                SHA-256:5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
                                                                                                                                                                                                                                SHA-512:7B1D821CF1210947344FCF0F9C4927B42271669015DEA1C179B2BEAD9025941138C139C22C068CBD7219B853C80FA01A04E26790D8D76A38FB8BEBE20E0A2A4A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:MSCF............D...............#................A..........d........B..............environment.cab.x.\&..BCK.\.T...N.....;LB.JW.. .w!....$*...U....."........ (.. E..........w...e.Jf.3gN.{...{V.M4.!.....hn. p(... .a...f..f..j.....Kh5..l.DB\}.=.0.>..X.....z..,'..LC/>....h.>.>.........,~mVI.....'EGD]^..\{....Q....f...4.F.....q..FF.1~...Q,.."g.qq.......}.....g%Zz.;m.9..z../2Jl.p8wGO......-V....FM......y*.....Hy.xy......N.r;.@uV........Xa...b].`..F...y.Wd.e.8.[Z.s7].....=B.$...'.|.-.sC....a_(..$..i.C.T.F}...]...m.R,y.1...'..j3.....ir..B..)sR.G.*..`-=.w....m..2y.....*o...\{..C.4.:ZM..wL-$.I.x:?.!.....:..W.%&.....J.%.....~....E..T.d.Q{..p..J..pY...P../.."rp....`...#w.....'.|n%Dy,.....i....."..x.....b._..\_.^.XOo..*:.&a.`..qA.?.@..t.R/...X3.nF.&........1Z.r.S...9x........?..aP..A...f..k:..\....L...t....Q...1..A..33A1.t..)...c....;......$.$..>._....A.!g`..t...b.H.L..&.....!......v~.n...uE.x...."5.h.4..B.R.d.4.%--.`.B..."..[....l......x(..5......@.zr....

                                                                                                                                                                                                                                C:\Windows\Tasks\explorgu.job

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe
                                                                                                                                                                                                                                File Type:data
                                                                                                                                                                                                                                Category:dropped
                                                                                                                                                                                                                                Size (bytes):294
                                                                                                                                                                                                                                Entropy (8bit):3.4276940314341426
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:h5bygvXUG5ZsUEZ+lX1yrlbtFXqYEp5t/uy0lVlMct0:hMuYQ1yrBfXVPdt0
                                                                                                                                                                                                                                MD5:D67DAEB3ECEB867B99307C2A564FF2EC
                                                                                                                                                                                                                                SHA1:1080D2A364BA5DC8EBD8BA37ED161D6C983DBB1D
                                                                                                                                                                                                                                SHA-256:B50C55E992DA9B13F36ABD3F52F7C9199F8C668616666586404B1B147D56439C
                                                                                                                                                                                                                                SHA-512:F47597DA41C50E7D46CE3FA8E2AE6FBAE89222C79FF1C1121E3E8CF97A3184108BE8A3D87FF8E7C6A42C90CADECC52975ED60E38AF64C0A01336580663A708CF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                Preview:.....f...~5G..v$LE.sF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.0.c.0.7.2.6.0.d.c.\.e.x.p.l.o.r.g.u...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................(.@3P.........................

                                                                                                                                                                                                                                Chrome Cache Entry: 1000

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):216277
                                                                                                                                                                                                                                Entropy (8bit):5.455502756372822
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:j0nzyu8ItYoHFldaY4xzuQVLlGDPcHGcpP:QnCuYgTaY4/GqGQP
                                                                                                                                                                                                                                MD5:92BBD73283CCF052912D68922E212C38
                                                                                                                                                                                                                                SHA1:92F9A1D0628EE58A31E234953548FF16E3B390B4
                                                                                                                                                                                                                                SHA-256:BD33427A7076736CB9783D3E994B178A1882002E5B3F2D902D204A47A96AEA77
                                                                                                                                                                                                                                SHA-512:D854079F95E08F624D8B0E27732F54A8D17C33B0F3661E7D9370CEC5418605BBBCC689930462A261CD92570CE4F30CD8457A4CDA702C29B73DA05B00628FD0F3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlEEgWEfV3yt47xiVu7pvO4I3STIzw/m=_b,_tp"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x1689603f, 0x2040058e, 0x3f34e599, 0x30e4e33d, 0x0, 0x0, 0x3006b000, 0xe, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Ra,haa,$a,cb,db,eb,fb,iaa,gb,lb,jaa,kaa,pb,naa,paa,Eb,qaa,taa,vaa,Aaa,Qb,Caa,Daa,Iaa,Oaa,Paa,Maa,Qaa,Vaa,Waa,Yaa,Zaa,$aa,aba,Lc,dba,cba,fba,Pc,Oc,hba,gba,kba,jba,Vc,nba,oba,dd,cd,Rc,zba,wba,Aba,Bba,Eba,Gba,Hba,uba,Qd,Rd,aca,je,cca,ke,dca,fca,hca,lca,mca,nca,oca,rca,tca,xca,yca,Cca,Mca,Ica,Oca,Qca,Rca,Uca,Wca,Zca,$ca,ada,bda,cda,fda,jf,gda,ida,lda,mda,aaa,nda,Af,oda,Cf,pda,qda,Ef,sda,Gf,zda,Dda,Cda,Of,Fda;_.aa=function(a){return f

                                                                                                                                                                                                                                Chrome Cache Entry: 1001

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):15920
                                                                                                                                                                                                                                Entropy (8bit):7.987786667472439
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:sShqOXQlaSchOwK0uFvRqq3xR/xb5OY3aU/lHS9WE2YeK1os:sShJKaScJK0uFvRvxb5OY3aU/lHkmK
                                                                                                                                                                                                                                MD5:3A44E06EB954B96AA043227F3534189D
                                                                                                                                                                                                                                SHA1:23CEF6993DDB2B2979E8E7647FC3763694E2BA7D
                                                                                                                                                                                                                                SHA-256:B019538234514166EC7665359D097403358F8A4C991901983922FB4D56989F1E
                                                                                                                                                                                                                                SHA-512:FAB970B250DD88064730BD2603C530F3503ABB0AF4E4095786877F9660A159BF4AD98C5ABEA2E95EB39AE8C13417736B5772FCB9F87941FF5E0F383CB172997F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
                                                                                                                                                                                                                                Preview:wOF2......>0.......T..=..........................d.....^.`.. .\..<.................6.$.... .... ..S.!.%c.......|y...6..;.s#.....x_<..o..........l...J.`p.m..6...h....U.pD...R.J.$...W..`7w...[..qD....<P......J.x.+J-^....va...:.KW..Ph...."....{.W4C....p..1..........CH.....P.............Q%.=.F.....1.%J....d..X..J.<AU..b.N...<l...d...f..^Y..]..&...VQ.<.....F..{.....&{.+J;.... .2P.:.*5..?.o.|....V[t..M..#..d.fv...........4..`.).h..h......@u........4......~.....r.B...p1.P.T..<....r....Y..8...GQ1.t.....%..-Wh..:W.....1l-...@..hL}...lN.._.j...D`..sn.=(...W..?.Z..p.52..H...X...)..CJ...V..*7.....<|..i...{...R.M+[..|..x-..M3...~!\.l6}.T.o.R'$.)..-.W.T....A...5?.{.2.bR.../....*l..;...{..I>.n..MJ.2........U&. ..(L]].%P.$..p59.LD.f.........V.....z.5~.2\......#.4....9_....%wp.OU.0.....CK..../.x. ..A2e...@...(.i..f./.....`1.......!......@....0 vbt.e v./!...N=>:..A...(...f....?.....iH.F..!k.6.O6S..54.^c..2.G.?6....)b......lv.,h....Y.}.?..uk....L.4d.g..6.\.1u..

                                                                                                                                                                                                                                Chrome Cache Entry: 1002

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):52
                                                                                                                                                                                                                                Entropy (8bit):4.542000661265563
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:yVkxzNDrMKcwVbF7KnZ:yVkxtkwVbF7KZ
                                                                                                                                                                                                                                MD5:B3B89B9C275343BC6798E3A83564FDDB
                                                                                                                                                                                                                                SHA1:32367475C527C3F5E5DB0BF42C348816FF4D157B
                                                                                                                                                                                                                                SHA-256:900FB968F7FD9EA55F600AC9002A89E56AB56597DA7BDE04DEAAE6CC77AEB276
                                                                                                                                                                                                                                SHA-512:ADB6938104E802B0936630B216CDE732F21ECA6E60E7A31D1B9C8FF52B5A66A712A7ECDE3F8ED4915D15C0A71C33A9788060E1E22999094C39020A1F8C636874
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
                                                                                                                                                                                                                                Preview:CiUKDQ0ZARP6GgQIVhgCIAEKCw3oIX6GGgQISxgCCgcN05ioBxoA

                                                                                                                                                                                                                                Chrome Cache Entry: 1003

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):6636
                                                                                                                                                                                                                                Entropy (8bit):4.762377523885447
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:Gm6G1ItjXwOJvVLATqcQLSIt8xmumUu1ixHRs:j60I1BJvNPcQH8xmumUuixHRs
                                                                                                                                                                                                                                MD5:B3C466B2D513DB8CCD0F4D7C4648E05B
                                                                                                                                                                                                                                SHA1:6BC28BFDBA5C7DF8B455A3B88D4C4D9523CCA860
                                                                                                                                                                                                                                SHA-256:4B4A165585BBA9DA803F7BE0C0F06EA2B97BC1C61B4BF6921AD44E8C6369BF2F
                                                                                                                                                                                                                                SHA-512:43B6E557980C00C5EBA6D5729E7865DF82707D9611477FB2E3EC271C7EB19ED6870723F68ADDBE254D7867DA5FE89ADD8F10BA2AFD75C2B101140FD3F6F8C891
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/success.mp3:2f7070b0ce60c5:0
                                                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz...............................................n...f...`...k...j...f...h...a...i...e...i...b........stco................udta....meta......."hdlr........mdirappl.............oilst.....nam....data........got_it....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 000002AB 0000000000004915 000000

                                                                                                                                                                                                                                Chrome Cache Entry: 1004

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (10590)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):30454
                                                                                                                                                                                                                                Entropy (8bit):5.576137902379071
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:8/86aj6dY3cJpu4MN0As67qVOqIfhE8r8to8p85at48Wpe8KU8s7MiT8PtFvd:87aj5MJpu4MN0As6H5Gt4vuiTEZd
                                                                                                                                                                                                                                MD5:80EC39CA7A3BE13B675B5751FFBF45B0
                                                                                                                                                                                                                                SHA1:82161B242CFF2FBE988C3A838A057F083D524F40
                                                                                                                                                                                                                                SHA-256:C41583B8960E530A88B12C0780549D8C99A74B2CC5F983C686B6C585F699D98B
                                                                                                                                                                                                                                SHA-512:0382ED1DC9F412B176B514365C9AAFA1495D5FC692F07773F42C5F9E5EFCB7229ED16F14A48184C5850395D5037A3474D92C641020149F514767BB12F474D001
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iYu44/yU/l/en_US/nNbHix9dhZw.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("GroupsCometMemberProfileLink_group.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"GroupsCometMemberProfileLink_group",selections:[{alias:null,args:null,kind:"ScalarField",name:"answer_agent_id",storageKey:null}],type:"Group",abstractKey:null};e.exports=a}),null);.__d("CometDisabledContext",["react"],(function(a,b,c,d,e,f,g){"use strict";var h;a=h||d("react");b=a.createContext(!1);g["default"]=b}),98);.__d("BaseHScrollConstants",[],(function(a,b,c,d,e,f){"use strict";a=1600;b=10;f.MAX_CONTAINER_WIDTH=a;f.WIGGLE_ROOM=b}),66);.__d("smoothScrollTo",["ExecutionEnvironment","UserAgent"],(function(a,b,c,d,e,f,g){"use strict";var h,i=c("UserAgent").isBrowser("Firefox");b=(h||(h=c("ExecutionEnvironment"))).canUseDOM&&window.matchMedia("(prefers-reduced-motion: reduce)");var j=b&&b.matches,k=(h||(h=c("ExecutionEnvironment"))).canUseDOM&&document.documentElement!=null&&"scrollBehavior"in document.documentElemen

                                                                                                                                                                                                                                Chrome Cache Entry: 1005

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):315
                                                                                                                                                                                                                                Entropy (8bit):4.648861696465887
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4LIPGDQyIlOWLVJ1WnkX2Wtti0+DrTwtDZi:t4noU/vmRLIO8yIlVVuPWI0gTGQ
                                                                                                                                                                                                                                MD5:9F40343399D2331A8E5DE01251A1F258
                                                                                                                                                                                                                                SHA1:FF3A3A2AB18BAFA30B09E09A083C3699263A10FC
                                                                                                                                                                                                                                SHA-256:CB4F6AB460370D669DE4694A4FB0090C3FADBCDB8C395C813A0680C90C29BFF3
                                                                                                                                                                                                                                SHA-512:3F888927E6DE57D021AA124C5894CAFB54BEE195047D12AB55FDED7C6444AB14C3CE4F3DCAB9E9D06E785EA82FC7A96BE4EAAB6639BF721FF6F698D8760486ED
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/mic/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c-1.66 0-3 1.37-3 3.07v5.86c0 1.7 1.34 3.07 3 3.07s3-1.37 3-3.07V6.07C15 4.37 13.66 3 12 3zm6.5 9h-1c0 3.03-2.47 5.5-5.5 5.5S6.5 15.03 6.5 12h-1c0 3.24 2.39 5.93 5.5 6.41V21h2v-2.59c3.11-.48 5.5-3.17 5.5-6.41z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1006

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):331
                                                                                                                                                                                                                                Entropy (8bit):4.856840067199089
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4bib4Gt/6qnFJ+5LZ9i3JvGUuWLV1iDQ38:t47N9U/vmReb4s6qbmqvVU8M
                                                                                                                                                                                                                                MD5:F7D38F81D0E430C65C517D480A82DEC2
                                                                                                                                                                                                                                SHA1:61A70D1586756FC2570A6DF4B440C10EBE3312B0
                                                                                                                                                                                                                                SHA-256:D63DF87F634535A4731B74CD9893C855373507C3250FF485E982442DAB0380BA
                                                                                                                                                                                                                                SHA-512:273652346614D9F8DE8B0AAB7BD13D4F5EBFBA1D27338D87E4F27DA58925FA9699E0367C9C0B74BCF6AF95AD5B9A48ECCEE0710F1593ABB96B705A551D202FE9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/mic/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M13 18.93V21h-2v-2.07c-3.9-.49-6-3.8-6-6.93h2c0 1.93 1.36 5 5 5s5-3.07 5-5h2c0 3.13-2.1 6.44-6 6.93zM12 15c1.66 0 3-1.37 3-3.07V6.07C15 4.37 13.66 3 12 3S9 4.37 9 6.07v5.86c0 1.7 1.34 3.07 3 3.07z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1007

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):312
                                                                                                                                                                                                                                Entropy (8bit):4.958737908772462
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4AFMGaBoxnOLgQsS0ISSa/KW8xGeDogniLELo:t47N9U/vmRXGaBoVOLgbvSoN8xGzEo
                                                                                                                                                                                                                                MD5:22698ABCC833E1218C3EEED7C534A400
                                                                                                                                                                                                                                SHA1:247102BA81E345DFD0C7374C4AB9B894C8A9704B
                                                                                                                                                                                                                                SHA-256:A3A94E1842AA40BD34D65EFF8EA6F8EAABE15CC9947C26FE1CFFB3274F83121F
                                                                                                                                                                                                                                SHA-512:E0C67655E2E2A955D52D0B1415A3931C5D2111AD12E66BCBDB89C4E4AF3E27701CCB5407F62896C2340BACF7D20E86C2ABCB03332C76C48AE62B83BCB1B612C4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/thumb_up/v17/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M3,11h3v10H3V11z M18.77,11h-4.23l1.52-4.94C16.38,5.03,15.54,4,14.38,4c-0.58,0-1.14,0.24-1.52,0.65L7,11v10h10.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1008

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (4626)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):23279
                                                                                                                                                                                                                                Entropy (8bit):5.407857871342186
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:bBQaRLUCHqNBPWqYjqr70r2vZ7Jg8qlL2XikJyJpXZ:bzLUCKNBzYuX0r2hJJBYTXZ
                                                                                                                                                                                                                                MD5:7001296FE9C04A4056B6AEE2E4CA1977
                                                                                                                                                                                                                                SHA1:CCDCF52DC50A43D48452633F6E4D0B17B7C7F008
                                                                                                                                                                                                                                SHA-256:7A18C2C3022B0FFDCA24E076929CAF4F053FED4C1E8ED3DB08BBE0DAE1F11332
                                                                                                                                                                                                                                SHA-512:9B81E709540455174A90594B7509E0E529FD69B5E029E160EE824978EFA9243973E473578FED9CCF04F73952F98A5190BDA5C7DE7A7AD469DA4EB18333E67C57
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3ib3v4/yo/l/en_US/vwqID5lbHXG.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometInputWithCommands.react",["CometComponentWithKeyCommands.react","CometKeys","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||(h=d("react")),j=h.useMemo;function a(a){var b=j(function(){var b=[];a.enter!=null&&b.push({command:{key:c("CometKeys").ENTER},description:a.enter.description,handler:a.enter.handler,triggerFromInputs:!0});a["delete"]!=null&&b.push({command:{key:c("CometKeys").DELETE},description:a["delete"].description,handler:a["delete"].handler,triggerFromInputs:!0});a.up!=null&&b.push({command:{key:c("CometKeys").UP},description:a.up.description,handler:a.up.handler,triggerFromInputs:!0});a.down!=null&&b.push({command:{key:c("CometKeys").DOWN},description:a.down.description,handler:a.down.handler,triggerFromInputs:!0});a.tab!=null&&b.push({command:{key:c("CometKeys").TAB},description:a.tab.description,handler:a.tab.handler,triggerFromInputs:!0});a.esc!=null&&b.push({command:{key:c("CometKeys").ESCAPE},description:a.esc.description,handler

                                                                                                                                                                                                                                Chrome Cache Entry: 1009

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):216
                                                                                                                                                                                                                                Entropy (8bit):4.947192163768535
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4mqUEUKFI8iyNd1LkBEo8:t4noU/vmREaI83O8
                                                                                                                                                                                                                                MD5:FAF3B1C051434D1FC1CFC3335A1015AF
                                                                                                                                                                                                                                SHA1:A04C68D74A3CCD626617EFEC131D004F4594EF53
                                                                                                                                                                                                                                SHA-256:C32E7D6B3FC895BB9D822E322CD3D39C49CAEFA647E4FABFC3DD8926FAEB89A4
                                                                                                                                                                                                                                SHA-512:23BDBD1C69E5B225A417646E742D7F238D7E311A17C866CE563CC82791054CF065F7C0CCD0970E8CAF75A340F1D3D5164BE257578BBE0AC0E8C15A2BCF862022
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/clapperboard/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM18 9l1 3h-3l-1-3h3zm-5 0 1 3h-3l-1-3h3zM8 9l1 3H6L5 9h3z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1010

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1705
                                                                                                                                                                                                                                Entropy (8bit):7.09338569990802
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:4qEo/zPc1sppr41tAJ2FKmyhWjNW0Il7bj1Ay7WnIvTuwrK7aCRS3e8QlBDBCinr:6oLiWpr41O4zjED1XiaMBDBC8
                                                                                                                                                                                                                                MD5:FC80E5038C98F908E971F483DDB3D608
                                                                                                                                                                                                                                SHA1:C6832DE0EBFD85D98C2724173F0C55297E3C951E
                                                                                                                                                                                                                                SHA-256:35C9D6C139076BCF18177D95077D9B1A4F12B44CF5E97DFE47E3EA142BF85C8A
                                                                                                                                                                                                                                SHA-512:48B75B1D3012117EE37746AD77B5BF6D2356B6EA063F7FAEC0A9D38E254F7C62754FC5A84B050FE79EFA6CD02F11DC394171F11E8101BF320FB5D656C03A6D39
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t1.6435-1/160178471_276304963858358_7320714899070727730_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=c7e18e&_nc_ohc=2RkrhOQfsOgAX9nl03-&_nc_ht=scontent-lga3-2.xx&oh=00_AfCjtmu8aWkVUAjpXBah3r19aoeZ3tZFkj7n2yL_AqLj1g&oe=65FCB60C
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM..........g..V2GoIpxMY88EHlGfbmQc..(.bFBMD0a000a86010000000200009c020000e00200002f03000006040000c5040000ff0400004005000085050000a9060000...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................s.z..y..w.M..a.Z.5..j......J...|...n......)O.5...Uka@;w.<Sh.......&............................4..!"$35............c..P..\..r\..%s..(.k.e`..0,..G7.M...`.j:$.@.....|L."$0.U.${l^.......I.h..<mYS........(.r.......i.jN..g... ........................!"13Aq........?..:wd.@.i.MK5..q...?s.._.}.............................!12A........?.YoR.q.G..\....T................................1A.! "QRqr...2Ba............?..,...#".._a.!WS...#*.?.......A.....{q\8PNV.......9..H .0..P..,K\:.V.....(.A;S;kL;....b..s$.k.@...r[..0..h....e......e'?...Z-..9=.R..:x.t.I..<.{..s@.3..aE?.a...%.....

                                                                                                                                                                                                                                Chrome Cache Entry: 1011

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):111
                                                                                                                                                                                                                                Entropy (8bit):4.980379097367065
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5KVErcHgDXFUVLUJRVFiAdFUvuII9rP0WTC:tI9mc4slmgSVLU9FRF0ul5TC
                                                                                                                                                                                                                                MD5:7A85DE03D089077BC1F895B1EA91907F
                                                                                                                                                                                                                                SHA1:B86AF0404FED40A12228084B3B090DF8DBE50C0B
                                                                                                                                                                                                                                SHA-256:179FAF7C791CF27682668324B60182039191B22B3AC85069C8BEBBA418DB9A1D
                                                                                                                                                                                                                                SHA-512:8669E2B41453760B0C67C0701C4EFB4DCF6F544FDB84259383B5E9C64DA4E99DA37CDEC717ECC02E7BB919390E8187877EA125C367456C94B0245BD04E7FB4D4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/keyboard-arrow-up/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 1012

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):15552
                                                                                                                                                                                                                                Entropy (8bit):7.983966851275127
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
                                                                                                                                                                                                                                MD5:285467176F7FE6BB6A9C6873B3DAD2CC
                                                                                                                                                                                                                                SHA1:EA04E4FF5142DDD69307C183DEF721A160E0A64E
                                                                                                                                                                                                                                SHA-256:5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
                                                                                                                                                                                                                                SHA-512:5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
                                                                                                                                                                                                                                Preview:wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v.*.7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....|...H....Fk.*-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..|..d...|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

                                                                                                                                                                                                                                Chrome Cache Entry: 1013

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):157
                                                                                                                                                                                                                                Entropy (8bit):4.866482514263467
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHLLWQlXI1/ymUwHMQMQtnQSb8:tI9mc4slhohC/vmI4NXa//1RtnQo8
                                                                                                                                                                                                                                MD5:C62423FDC7866B06AF4889BE619900A2
                                                                                                                                                                                                                                SHA1:93BEEE6DEA1F9CB906B794F182949F357AAC06D0
                                                                                                                                                                                                                                SHA-256:C47564ECC26A15C0A2381733FBF821EDFDCC17A4A8B946380B6308C6381517DF
                                                                                                                                                                                                                                SHA-512:4E7CFB526D804C30F4DAED59EA03709BF9D311BF4F30FC090F4032B9C8D12E73789798BD5A5A5AFBE889B009A1BB12E7939577055FC983520E7F93334DABD5EA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_down/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m18 9.28-6.35 6.35-6.37-6.35.72-.71 5.64 5.65 5.65-5.65z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1014

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):4.519025420255455
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4sl5RINAvxm6lzjQewRNGBvLl1ZX1i0dTnUMSdR+trpYmQkDEJM:t4vqNAJXpQewC5pDpU6VYFG7
                                                                                                                                                                                                                                MD5:DDABFA57FD16BDBA85E2FD30B2B0FEFF
                                                                                                                                                                                                                                SHA1:9FC8CD1D34223C54E0C86922F2DE68AACBE6E57A
                                                                                                                                                                                                                                SHA-256:B60F66156BC26031D7F02CC7CAAA6D7277D56F1821ED55280F67446AA3643640
                                                                                                                                                                                                                                SHA-512:1AD6D890CADC461D74821065143FBE1AFC882C106ED646F41CB2BC12D00D6FCC6E9C68C7FAA7F260F2FABAFF68689EA0DF48CEA54FF40AF505B4A632D67F1B5B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/refresh/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path d="M13 9v2h7V4h-2v2.74C16.53 5.07 14.4 4 12 4c-2.21 0-4.21.9-5.66 2.34S4 9.79 4 12c0 4.42 3.58 8 8 8 2.21 0 4.21-.9 5.66-2.34l-1.42-1.42C15.15 17.33 13.65 18 12 18c-3.31 0-6-2.69-6-6 0-1.65.67-3.15 1.76-4.24C8.85 6.67 10.35 6 12 6c2.21 0 4.15 1.21 5.19 3H13z"></path>.</svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 1015

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):346
                                                                                                                                                                                                                                Entropy (8bit):4.782195104649308
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4eTgAV99WTc6XzQuJ3/vh7QrB9TzUuM8XGk+LlvDME:t4noU/vmRSgQ9Ec6jhJ3XtuM8sL9DME
                                                                                                                                                                                                                                MD5:A81BADB0BAAD5A9F30C4F71D94F2C09A
                                                                                                                                                                                                                                SHA1:74DEBED4DAC92DB3B79CCFA1BDD2C93852D2A2B4
                                                                                                                                                                                                                                SHA-256:C46134C020CDF3060355F81622A054C9F23A4F04AA887876851796FA6243C80D
                                                                                                                                                                                                                                SHA-512:1F3975165382775F332EE96ECD6BBB06952D583E72E75DD3984860C932D0D88FB04B182842C3F3318455A322F6E01B7C50A0C0C46E861D45542A8F25CC03F9B8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/bag/v4/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M16.9 6c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44-1.73 2.01-3 3.87-3zm0 11c-3.31 0-6-2.69-6-6h2c0 2.21 1.79 4 4 4s4-1.79 4-4h2c0 3.31-2.69 6-6 6z" fill-rule="evenodd"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1016

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 512 x 512, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):974
                                                                                                                                                                                                                                Entropy (8bit):5.216450354686419
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:6v/7vMh7lM9ekQipyhCsPo+KlYlUNQQroW/mzzzzzzzzzzzzzzzzzzzzzzzzzzzk:6MhJ5lo/qA9WJ20c
                                                                                                                                                                                                                                MD5:2B52BA34971A0B3D785DC040257FCCAA
                                                                                                                                                                                                                                SHA1:AE589D45BBB027DDD6AD2E1131EEDEA8FC7F5977
                                                                                                                                                                                                                                SHA-256:B9F6C9DA73DBF806E64CF4437ADE67A2EF48731E27E99E7F0743FDA275E28A68
                                                                                                                                                                                                                                SHA-512:603A51585A4D096C4AC9CDFA87A24374124AD4AFAD53D96E36B8ABE296DED9B2EE72610424D00FF6C1015A05BA9DE767FD77695D4926B593027C476B8774139E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/web/shortcuts/subscriptions_512x512.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR..............$....QPLTE.................................................................................%..g....tRNS.!.. .@P`......0.._p...A.'*.....IDATx....J.a........ZZ._].)i.!.....".y.@.......................................................................r.Z...s.n24... .......@.... ..._.g-Cr...............|7.e.NG.\..]..........@.... .......`.!..;..................U.E......;........@.... .......@........]......]J.L..@.... .......@.... .......@.... .......@.....U...y.^.2..=,...3..~.....k....................................................................................................................~9.@e..Q..=...i.Y7.$..j.o}.t.].._....p.].._....p.].._....p.].._....p.].._....p.].._....p.].._.........?.@7{.5...o.<.............p.........p.........p.........p..p.S...._......@.... .......@.... .......@.... .....n.<.-7..8.)mc....@.... .......@..>..........................................................................Z.:.....IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 1017

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):15344
                                                                                                                                                                                                                                Entropy (8bit):7.984625225844861
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
                                                                                                                                                                                                                                MD5:5D4AEB4E5F5EF754E307D7FFAEF688BD
                                                                                                                                                                                                                                SHA1:06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
                                                                                                                                                                                                                                SHA-256:3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
                                                                                                                                                                                                                                SHA-512:7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
                                                                                                                                                                                                                                Preview:wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h|.l....A....b6........(......@e.]...*:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#*e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.*UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...*$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf*.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed.*.'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

                                                                                                                                                                                                                                Chrome Cache Entry: 1018

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):473
                                                                                                                                                                                                                                Entropy (8bit):5.240157994693449
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:kxeXjxeX4wFbcloiHKobO4xMl23ZhVgBDKDi7e8kbRNfeX60:kMYDRiqobPxi2fVgB+XprGJ
                                                                                                                                                                                                                                MD5:13782B3B1A5B6B82B186225398C96C55
                                                                                                                                                                                                                                SHA1:AA9E89FABF00C27173190096499F47FAEE56C684
                                                                                                                                                                                                                                SHA-256:1EAF3863ADA2FC1BC5C99F0731313B8046C576403EC8721757F935B8245C2C26
                                                                                                                                                                                                                                SHA-512:D966BA31E97827381C2F26E9DC069A6DA26EFFEE26AE9C1965A73C1CFB4A852A6F4C94BF60B1F33719A3AF522CA0B868D99833E422FDEAD8644BD527118AE685
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=XiNDcc"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.HIa=_.y("XiNDcc",[_.Nna]);._.k("XiNDcc");.var DI=function(a){_.J.call(this,a.Ha);this.aa=a.Ea.ez};_.B(DI,_.J);DI.Ba=function(){return{Ea:{ez:_.CI}}};DI.prototype.kB=function(){_.b3a(this.aa)};_.K(DI.prototype,"IYtByb",function(){return this.kB});_.M(_.HIa,DI);._.l();.}catch(e){_._DumpException(e)}.}).call(this,this.default_AccountsSignInUi);.// Google Inc..

                                                                                                                                                                                                                                Chrome Cache Entry: 1019

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1738)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2477
                                                                                                                                                                                                                                Entropy (8bit):5.4374502845572525
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:YzcIe4KH/M/TD6CUvU3vpfKYriTFQsC02Ec3b9:YQ9H/Gf73xnWTOecL9
                                                                                                                                                                                                                                MD5:B4948C7BFE2D4AEBD9EB3AEABC909110
                                                                                                                                                                                                                                SHA1:935F743DADD2E5AE5C65D0E8BB1092430AB5FA26
                                                                                                                                                                                                                                SHA-256:67F059105C4A6782057AB478BFF9135A681CD951FD6203DF096FA2A4E8663E9D
                                                                                                                                                                                                                                SHA-512:986B28DD77EE735F3BBAC57B45594053D0AEA8CE9E5CD6837DB5CE4446ADD9C768458D0F84FFAC5441A370FF16829490827175420589CE93AA5FC9BAEFC099D0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/_5vDGAzPQ3H.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("Qe2JsExposureFalcoEvent",["FalcoLoggerInternal","getFalcoLogPolicy_DO_NOT_USE"],(function(a,b,c,d,e,f,g){"use strict";a=c("getFalcoLogPolicy_DO_NOT_USE")("1837559");b=d("FalcoLoggerInternal").create("qe2_js_exposure",a);e=b;g["default"]=e}),98);.__d("QE2Logger",["Qe2JsExposureFalcoEvent"],(function(a,b,c,d,e,f,g){"use strict";var h={};function a(a,b){B(a,(a=b)!=null?a:"",9)}function b(a,b){B(a,(a=b)!=null?a:"",9,!0)}function d(a){B(a,"",4)}function e(a){B(a,"",32)}function f(a){B(a,"",32,!0)}function i(a){B(a,"",54)}function j(a,b){B(a,b,3)}function k(a){B(a,"",5)}function l(a){B(a,"",5,!0)}function m(a){B(a,"",31)}function n(a){B(a,"",98)}function o(a,b){B(a,b,7)}function p(a,b){B(a,b,55)}function q(a,b){B(a,b,17)}function r(a,b){B(a,b,25)}function s(a,b){B(a,b,8)}function t(a,b){B(a,b,22)}function u(a,b){B(a,b,27)}function v(a,b){B(a,b,0)}function w(a,b){B(a,(a=b)!=null?a:"",89)}function x(a,b){B(a,b,60)}function y(a,b){B(a,b,90)}function z(a,b,c){B(a,b,c)}fun

                                                                                                                                                                                                                                Chrome Cache Entry: 1020

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):163
                                                                                                                                                                                                                                Entropy (8bit):4.900439585813596
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHMwYSf104XTIUGnYRt8n+R9ZK/:tI9mc4slhohC/vmI4NX104XEUv8
                                                                                                                                                                                                                                MD5:5D73D2DFB1BEA872F0CEB93909FE6887
                                                                                                                                                                                                                                SHA1:DEF95E494B458D0E5B4BC0B082AB6C791216E932
                                                                                                                                                                                                                                SHA-256:EB908A46A75151ADC11154E759DB9BE111AFC67CDA5317AC26B43E3654FD4BD7
                                                                                                                                                                                                                                SHA-512:2F44B65FE52EE707D1696DE15EC18DB38521D5A848C3F9BD1352BF7BC2A8CA07CF28A98ED891D663F062CA952C72F0082ADB556053D827811E638D649E8FCB2D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/list_play_arrow/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M22 7H2v1h20V7zm-9 5H2v-1h11v1zm0 4H2v-1h11v1zm2 3v-8l7 4-7 4z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1021

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1555
                                                                                                                                                                                                                                Entropy (8bit):7.107402048079722
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:T1hfvWwjx82lY2T3iV7vyJ3VzBYGsBq/qnmnTWApAvgBFBDd4WhjDFWyJZm:ZANn2esJ37Yf583eohTlJZm
                                                                                                                                                                                                                                MD5:12430F012C4B6B4A91C63CBF1369E1FF
                                                                                                                                                                                                                                SHA1:A8502ADE0C47E23230E5DA9D5658EC1F1DA309D6
                                                                                                                                                                                                                                SHA-256:079919E3400BA9BC0D569F5634CC41B2FD1B8E7A721B2B473D21F10FE2FA7F6B
                                                                                                                                                                                                                                SHA-512:17B7564088E12CD64AE79E7179EF4B26941370DC442528CB08320FC0D40BEC88D2B77124624685ACF9BA974467E27A7051703761C6FFFE5468C90217CAC5A4A6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/img/favicon_32x32.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)" xmpMM:InstanceID="xmp.iid:33B346918F4C11E7946BAB1AFF99627F" xmpMM:DocumentID="xmp.did:33B346928F4C11E7946BAB1AFF99627F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:13441FC48F4C11E7946BAB1AFF99627F" stRef:documentID="xmp.did:33B346908F4C11E7946BAB1AFF99627F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..6.....IDATx..MO.q.....X.B=./H..D...F...^8A........|....^...F...!..H...!.I.`Q.-.8........d.......<..'"....l

                                                                                                                                                                                                                                Chrome Cache Entry: 1022

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):616
                                                                                                                                                                                                                                Entropy (8bit):4.417992592628411
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRRSpPiaYjmnjdCOmwT2IgpEQx5nnQvqsRihtnRm31IEURwpY:t4jU/vtPnYynsrwT/ox5nnSVaZ+IN5
                                                                                                                                                                                                                                MD5:2E6B195059996451CC198378775A73BD
                                                                                                                                                                                                                                SHA1:D1F68BBCF0F62130D235D26F30D99BC1891C96AC
                                                                                                                                                                                                                                SHA-256:77729CACF85AB5D50BEB76F8C66D44DEAEEE396796F6F659CEB5A5AA2B1A8DA8
                                                                                                                                                                                                                                SHA-512:317D2E52F04F6FE420E5D6D38E849CE9B8E33602191A85954BB4CCB57976FDFFAF85ED654A6D3B58ABF5FB9A94440FA397850AF73D88728B39484BADA0F9E776
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/question_circle/v5/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M15.36 9.96c0 1.09-.67 1.67-1.31 2.24-.53.47-1.03.9-1.16 1.6l-.04.2H11.1l.03-.28c.14-1.17.8-1.76 1.47-2.27.52-.4 1.01-.77 1.01-1.49 0-.51-.23-.97-.63-1.29-.4-.31-.92-.42-1.42-.29-.59.15-1.05.67-1.19 1.34l-.05.28H8.57l.06-.42c.2-1.4 1.15-2.53 2.42-2.87 1.05-.29 2.14-.08 2.98.57.85.64 1.33 1.62 1.33 2.68zM12 18c.55 0 1-.45 1-1s-.45-1-1-1-1 .45-1 1 .45 1 1 1zm0-15c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1023

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1115
                                                                                                                                                                                                                                Entropy (8bit):4.113377443767523
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:t4jU/vD2M2hhkiDI7XGx8u3eSRNZM2kCC+8Vjb:t/TuhdDj8uOQNrkj+8Vjb
                                                                                                                                                                                                                                MD5:839C109F573BC61392F5F014B193988A
                                                                                                                                                                                                                                SHA1:F5D1DFEEA48DFC3410928EB155E6AAB4A4924A39
                                                                                                                                                                                                                                SHA-256:C54252CCA0B1AA43C5062281D39AA6E845679DDA9B056A5447036CBA8B3725FE
                                                                                                                                                                                                                                SHA-512:DC99CC192AC95D3E62C7585393304278D4C2D52A109051D8995200C941C1DE4A68A32F09B828F6853EE745BF1CED7E3AB680F9B30E8C7B1FE8F52DD55B79C08B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/gear/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 9.5c1.38 0 2.5 1.12 2.5 2.5s-1.12 2.5-2.5 2.5-2.5-1.12-2.5-2.5 1.12-2.5 2.5-2.5m0-1c-1.93 0-3.5 1.57-3.5 3.5s1.57 3.5 3.5 3.5 3.5-1.57 3.5-3.5-1.57-3.5-3.5-3.5zM13.22 3l.55 2.2.13.51.5.18c.61.23 1.19.56 1.72.98l.4.32.5-.14 2.17-.62 1.22 2.11-1.63 1.59-.37.36.08.51c.05.32.08.64.08.98s-.03.66-.08.98l-.08.51.37.36 1.63 1.59-1.22 2.11-2.17-.62-.5-.14-.4.32c-.53.43-1.11.76-1.72.98l-.5.18-.13.51-.55 2.24h-2.44l-.55-2.2-.13-.51-.5-.18c-.6-.23-1.18-.56-1.72-.99l-.4-.32-.5.14-2.17.62-1.21-2.12 1.63-1.59.37-.36-.08-.51c-.05-.32-.08-.65-.08-.98s.03-.66.08-.98l.08-.51-.37-.36L3.6 8.56l1.22-2.11 2.17.62.5.14.4-.32c.53-.44 1.11-.77 1.72-.99l.5-.18.13-.51.54-2.21h2.44M14 2h-4l-.74 2.96c-.73.27-1.4.66-2 1.14l-2.92-.83-2 3.46 2.19 2.13c-.06.37-.09.75-.09 1.14s.03.77.09 1.14l-2.19 2.13 2 3.46 2.92-.83c.6.48 1.27.87 2 1.14L10 22h4l.74-2.96c.73-.27 1.4-.66 2-1.14l2.92.83 2-3.46

                                                                                                                                                                                                                                Chrome Cache Entry: 1024

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (16083)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):740380
                                                                                                                                                                                                                                Entropy (8bit):5.729920688068108
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:ZA18+tja0OU+uiAlgU/u0rLDmi6Dcga7ciEskOxCoiuNRF:ZTGjvOZArrdciBkpSF
                                                                                                                                                                                                                                MD5:F98FC311A243467E1323D5CF6E73D4E9
                                                                                                                                                                                                                                SHA1:C917CCF1F88AA7D74C8CDD4B3A4B5C5270FFA520
                                                                                                                                                                                                                                SHA-256:86B01C31FAF78C4C275A4CD608DD112C461B7B3553D50129EFED438000D392A8
                                                                                                                                                                                                                                SHA-512:149022F0DA5D7491E9AE198D3DB033865AE1D0E399A0F0BD98BA3EDE34659461D0042B962D10B4DFD45DD29850C6FE734D6027DE00BE4493B8CAC31B6B401516
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                                                                                Preview:"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

                                                                                                                                                                                                                                Chrome Cache Entry: 1025

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1631)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):38504
                                                                                                                                                                                                                                Entropy (8bit):5.380911353336594
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:VkzC7vRxeiGDTwuMgroW6Cz7WRisKjcfqaCTCEUnqRkumnntnVT:bTeTgWJ7WqcfqaCTChqXGP
                                                                                                                                                                                                                                MD5:556588515D19D3F4678C16D0BB8DB99B
                                                                                                                                                                                                                                SHA1:E6887B21F0E68669311C70BF00250E55F6F6F029
                                                                                                                                                                                                                                SHA-256:994A75AF5B582099104F446BA121F0D315B47329B541600003D45C318C1280B8
                                                                                                                                                                                                                                SHA-512:5A7F9C2A3D1E6A46495A44C9EF5E85D3D154A197545FFCC0CA6C9C4FD14CD954BCC8D337B7D11EC041F839ED75564B15E9274E44CFD1EFCA39D3015EA090AF09
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.J6zlSvuPGsg.es5.O/ck=boq-identity.AccountsSignInUi.y688-Pa0BpE.L.B1.O/am=P2CJhmMBEISZlnP-nnFyGAAAAAAAAAAArAHs/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFQ8tmzv79x_nJGIapLTY1tp-HlWA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:yt7X5e;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Doa=function(a){var b=0,c;for(c in a)b++;return b};_.Eoa=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ja(a)||"string"===typeof a?a.length:_.Doa(a)};_.Vn=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map||"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ja(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.yb(a)};._.Foa=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg||"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ja(a)||"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.Ab(a)}}};.var Goa,Joa,Ioa,Hoa,lo,no,Voa,Moa,Ooa,Noa,Roa,Poa;Goa=function(a,b,c){if(b)re

                                                                                                                                                                                                                                Chrome Cache Entry: 1026

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):274
                                                                                                                                                                                                                                Entropy (8bit):4.691767704613487
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4tSSJhpbtnRm31IE2l0kjMswple9SY:t4noU/vmRtXVtnRm31IEURwpY
                                                                                                                                                                                                                                MD5:940A3FA042BCA1DB7543B418E574CCA1
                                                                                                                                                                                                                                SHA1:AF122097171DD4140E913C6DA8D3501819368165
                                                                                                                                                                                                                                SHA-256:3EB4200488142D98914FD98981C1C3E6F7C600D3A8E249826B5D72721DD6EE22
                                                                                                                                                                                                                                SHA-512:33D87129671F2FE4AB2055C0CEF5DA1067D900EB73FAF18A430F5124DD7D2B84DEA0308FB60ADFB060EFDDB09E482894758B4180440D6522A3DA0B0AB429F5EB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/clock/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1027

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (36945)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):140181
                                                                                                                                                                                                                                Entropy (8bit):5.409251244220194
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:erEarAE8EkFanSN/mFOB/mltKmLdEIwQGNGra3mRuh/sFhFHNreDog0akXkQhWt+:eW0xPENJ3mRu/sj9NrTZakWt6eA2+H
                                                                                                                                                                                                                                MD5:9B573BCB718A31275EC0B4311CE4A433
                                                                                                                                                                                                                                SHA1:28550F57CF577ED9068488EC42536C433B1992FB
                                                                                                                                                                                                                                SHA-256:BCE5FAC70A3C1EE99224DA729B39386CEF6DB6025B5533F73BEB049D7BB8B193
                                                                                                                                                                                                                                SHA-512:E3958DE26BA3B279EC2E3BBFF880A64AF89BCDD55CEE074161B13ECA6508B207FDC347AA1995AD03BD954D0C793281B1E389259AA262986E1AE0CFA0EB345BB5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://platform.linkedin.com/litms/utag/checkpoint-frontend/utag.js?cb=1708479300000
                                                                                                                                                                                                                                Preview:var tealiumDil,utag_condload=!1;window.__tealium_twc_switch=!1;try{try{var landingPageUrl=sessionStorage.getItem("utagLandingPage");landingPageUrl&&sessionStorage.removeItem("utagLandingPage")}catch(e){console.log(e)}}catch(e){console.log(e)}if(void 0===utag&&!utag_condload){var utag={id:"linkedin.checkpoint-frontend",o:{},sender:{},send:{},rpt:{ts:{a:new Date}},dbi:[],db_log:[],loader:{q:[],lc:0,f:{},p:0,ol:0,wq:[],lq:[],bq:{},bk:{},rf:0,ri:0,rp:0,rq:[],ready_q:[],sendq:{pending:0},run_ready_q:function(){for(var e=0;e<utag.loader.ready_q.length;e++){utag.DB("READY_Q:"+e);try{utag.loader.ready_q[e]()}catch(e){utag.DB(e)}}},lh:function(e,t,n){return t=(e=""+location.hostname).split("."),n=/\.co\.|\.com\.|\.org\.|\.edu\.|\.net\.|\.asn\.|\...\.jp$/.test(e)?3:2,t.splice(t.length-n,n).join(".")},WQ:function(e,t,n,a,i){utag.DB("WQ:"+utag.loader.wq.length);try{utag.udoname&&utag.udoname.indexOf(".")<0&&utag.ut.merge(utag.data,window[utag.udoname],0),utag.cfg.load_rules_at_wait&&utag.handler.L

                                                                                                                                                                                                                                Chrome Cache Entry: 1028

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):75348
                                                                                                                                                                                                                                Entropy (8bit):7.986223323795878
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:ruLPgZ/9a7g6h/nMIZ1EBzSQ9rtcfnOfCXd6avooaITVJEvWxcPdb:yLPkVatMo8/ywwdbvoUpSvWxoV
                                                                                                                                                                                                                                MD5:E2BF42048C4FAC7976265B339B09B884
                                                                                                                                                                                                                                SHA1:6D7644DB37F9D3D05C511BCF825633AD44AACAC9
                                                                                                                                                                                                                                SHA-256:0C2A8F02147BC31C649952E746A52F7A4D97ABA8E134CF54D40F892207CF5F9F
                                                                                                                                                                                                                                SHA-512:8543BAEF3615435A2F0ABBBC2C79D63D90D2789A3EE292D5139BBCAC55791DFB2CCB5DFAFCB297464B6D8CBA85D08530031A32EEEA653B4051C23EFAFF80D5FC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/425792721_408506441566749_3377289298669230651_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=esRaqpUeLsQAX9hQcJE&_nc_ht=scontent-lga3-2.xx&oh=00_AfDy26AjneqHTJX1GjD1rV4JYANu3TcPd03ijtB7MUzkZQ&oe=65D963FC
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100008a1e0000df4300005e4a0000035200001a72000052a900008baf000039b7000032c0000054260100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."......................................................................................yir..%....B&.*.%B*.*.*.rPQ......D..JPQ.F.J.r.(... "..!..........&4.J.O/(..r....T..kK..M.M.NT.M.%PERD.IJ.T.T.@)..j$..$U.P.....T.....CQCS..8@E.Xn.d.nA....c............V.+Z........ZJ.........$..$D........(j*. H."U....jr...5.-.f?........+...OZ.i..'.P....V.....*i*..".$T".".".A.F.. H.....P(...."..!.......|..*U.B.V.%V....F.bQ.F.-bx...X..B*...Z.-.+Pr...RJ.*.(.*I%H."...)@r.R.&.(.."...".!"..61(.#...J5b..bR.X..V1 .H5..V4.5.kS..C....h)R.j..@.jIRH..jH.$$B.T.@.@I.%.....P.Q.\...bx.bx.`.TbAQ...m.[........x.`z..7U..Z..P....P..$.H.jp.$i..".$..T..H.."."F.......#a9|....NV.<..U.x.`p.F..$n.....0<j.8oM..ME

                                                                                                                                                                                                                                Chrome Cache Entry: 1029

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 405x720, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):22638
                                                                                                                                                                                                                                Entropy (8bit):7.991277070480978
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:384:eoF4eqQ5uPQQpdXO1GpWbLFVgMVHZIiX/VacSRPL6ft7KrYStJGDSXHVt1hRflH:eheqQFtbLs+bXdaNGpSThX1N
                                                                                                                                                                                                                                MD5:636FB606C29D0AA736660778FB47D03D
                                                                                                                                                                                                                                SHA1:263B825F4F2D29816D5FDCB8D8A8303DB0DC3B2D
                                                                                                                                                                                                                                SHA-256:91959C232D124439BDDC0FDD022F8485CB7279B1C425080D3B24EB6D7FD902AB
                                                                                                                                                                                                                                SHA-512:D5457EB918CF88FBFECBC1447EE36096C67BB14FFC421E0B0808F4BA891D1EFD98E290B3F28519651284A18F50CA918C6A4F1A877ECE7E42C320BE6BCEE85633
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/mumzIyvyK08/oardefault.jpg?sqp=-oaymwEdCJUDENAFSFWQAgHyq4qpAwwIARUAAIhCcAHAAQY=&rs=AOn4CLAm_57_px050JwtcTvRa-xwRzRbVA
                                                                                                                                                                                                                                Preview:RIFFfX..WEBPVP8 ZX.......*....>Q$.F#...#r9....ej2%f|8}..R...!.h.(.^.3....9,p...c..o....`{....?H._.O....'..U.O...s.'.?.~.|..].........X............B...i....k.;?xy....~......>....-.....9?..[.s.;.....................?._.?..i...G.......J.....f........q.a............'....e....Q........)..o..'4......v...%6_....G."..#.K9..G.Pc..73.r.l..7~.Xt.RTY.R){@...Z..jMU...'.H....{.EHu.}*(..7....5...../..w.Ja0hf..{+......(.-N<...uai.......z...$..Ya.+".,..H.$>.?..Q.*....^.j)r6.~.*..P...g..*..h0..l35L..lW_...8..R/*.x.-..-.u....M..4^.d.VJ(d........._..t..EJr7\X.wo.....p.eR[v............G.fx...v.."..*..?...xR.........@..1..e........FH....F^........:..^(....!**d..?jPu'.@..xq..I...#...P.W5.>.[...].....|.ku.."s.f....H.......r.....w?.IDDJav.."Eq...<.^..,.......\..Kc>D..i.0..}. .RUL..E.o.#.ue,*"f..P...{.U..C..0..O.:sX\..N..W...$\.S.9...p^..).f..a&..0L.u..|.m8{........T.'...f2....E...w.Q.A.9c.;.....<.<.....Y.o.i.P.].}..s.9....q._.i..C5....[.wo$[.sn.f..V.J.Qn.[.i..XF

                                                                                                                                                                                                                                Chrome Cache Entry: 1030

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1210)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):78646
                                                                                                                                                                                                                                Entropy (8bit):5.412136972940148
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:w/Q5Up0BWTFRcxRpIoMwetxBJ9YDf4YRPlF/hyqqR4Qj2W:87mM1OxAx
                                                                                                                                                                                                                                MD5:908E3A26A43D87BAC9396377A9C4B6A8
                                                                                                                                                                                                                                SHA1:B9DDB61F1D0A4ED930881B909D3A4B01B2E62C7A
                                                                                                                                                                                                                                SHA-256:417FD55B390293D45901B37398ACFC8C3B4FEDE6A395F541C2EE48F732990D61
                                                                                                                                                                                                                                SHA-512:4FD58BA30456F96A8704412123BCA4C4A48E976E28BAEADED37232FA7A3C4C3FBAA6B79988DC7190D569D1B6024FB0C2F3EAD621A3E2D280C024D7EEC01011B6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/webcomponents-sd.vflset/webcomponents-sd.js
                                                                                                                                                                                                                                Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var k;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function p(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}function q(a){if(!(a instanceof Array)){a=p(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);function r(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b};/*..Copyright (c) 2016 The Polymer Project Authors. All rights reserved..This code may only be used unde

                                                                                                                                                                                                                                Chrome Cache Entry: 1031

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 48 x 48, 8-bit gray+alpha, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):324
                                                                                                                                                                                                                                Entropy (8bit):7.070439249747753
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:6v/lhPG9m/TXT1n3A9jmkwHBX6cQwFNWk5zgeVDotYnbyURf4Ff8NlGjoGg61V/7:6v/7+8jK6kwHBqTwFHtbVDoun/fFcjZz
                                                                                                                                                                                                                                MD5:F677725FD49AD483F4201EFA8CD09C19
                                                                                                                                                                                                                                SHA1:71F98EC38AC7CCE06B88F22CCB0478EFD76105F3
                                                                                                                                                                                                                                SHA-256:5F10D12ECCD25EC1E69339E9C954369D50429CD1475CBE8BAC4D81ED2598AFD3
                                                                                                                                                                                                                                SHA-512:290DB4CFBCC679F20D60461FC5DF75128B840C28D4621AA4DBFA7E1354F2A02F3AAD2FB30A89DB7729C4B326919291FAD0379B2FCADACDA150F19B005C6A8F3C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/googlematerialicons/video_youtube/v11/white-48dp/1x/gm_video_youtube_white_48dp.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR...0...0.......1.....IDATX..1..@.Em....B.sX[I...-........PhE...&........Y.f......2...`.C`a..kl....$W.2...^.BQ.J........y.~..8.a\-..E\.~.Nl*pY....X....X.;*..J.8..DT..W.D.......dM...b... ....@&'...\..*......;..m."?........[.......?4.W....`....c..T`..F...;.[..^..1.#.qtLen.4:...........e.....IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 1032

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):328
                                                                                                                                                                                                                                Entropy (8bit):4.751341136067324
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4TnMvnY0eLZ72LYMF5fcX1FCG/hd9qCWz:t47N9U/vmRjMvQZ7Bcpc/FqCu
                                                                                                                                                                                                                                MD5:DB10DFA9A782446C2C69099E4CBEBDFF
                                                                                                                                                                                                                                SHA1:92B57DC3DD3C747BEB1B8EB98D1CBC3D6AE9B7D4
                                                                                                                                                                                                                                SHA-256:A6BDEE4CE3188A10940EDC0B870B2898CA2E4311836712341546E3CDD08E3971
                                                                                                                                                                                                                                SHA-512:96499DB26CF175255484317AFC93B2CC96A5D18E235FC67B9ACBBB3E00B46B3A7E1E6C551764EEBB0A48856FFC2DB5DCA1EFFE478BB417B581E89D435A70449B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/search/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m21.24 19.83-5.64-5.64c.88-1.17 1.4-2.62 1.4-4.19 0-3.87-3.13-7-7-7s-7 3.13-7 7 3.13 7 7 7c1.57 0 3.02-.52 4.19-1.4l5.64 5.64 1.41-1.41zM5 10c0-2.76 2.24-5 5-5s5 2.24 5 5-2.24 5-5 5-5-2.24-5-5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1033

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):709
                                                                                                                                                                                                                                Entropy (8bit):4.22525639505645
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4noU/vmRhHmsiPU0BSMmpa8gQL8nJK18IyNzT+OfIXSVHIvEdQF60hRp2BquDnc:t4oU/vgHIBBSMcNgQL8nJKCzN1f/H2uk
                                                                                                                                                                                                                                MD5:DB14717F8EB9721D86499B6B2C41E379
                                                                                                                                                                                                                                SHA1:069496D31A0A689D73513F90E5BD72E2843581EC
                                                                                                                                                                                                                                SHA-256:15308D594C7B489C6AC3F05C0CB895EEF01DC2F0589FF08B3332C9500CDF7152
                                                                                                                                                                                                                                SHA-512:A089FD02232B9276377DA115205BC35DF666582F3697558E109A660DDB2AA8215DCB5D81CA54DCC2451E8688555B6DC19316C4D4098D12803B6379DC42C78178
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/youtube_shorts/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M10 14.65v-5.3L15 12l-5 2.65zm7.77-4.33-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 3.24 2.53 5.07 1.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-.07-1.42-.94-2.68-2.23-3.25zm-.23 5.86-8.5 4.5c-1.34.71-3.01.2-3.72-1.14-.71-1.34-.2-3.01 1.14-3.72l2.04-1.08v-1.21l-.69-.28-1.11-.46c-.99-.41-1.65-1.35-1.7-2.41-.05-1.06.52-2.06 1.46-2.56l8.5-4.5c1.34-.71 3.01-.2 3.72 1.14.71 1.34.2 3.01-1.14 3.72L15.5 9.26v1.21l1.8.74c.99.41 1.65 1.35 1.7 2.41.05 1.06-.52 2.06-1.46 2.56z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1034

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):287
                                                                                                                                                                                                                                Entropy (8bit):5.015529132385196
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4sl5RtOU0p4nEVkK+CJ1JrycDQnVkxGjU2ZIvhC:t4vfOADKPn5yB5jPMhC
                                                                                                                                                                                                                                MD5:64090EE2574D7F41444485BDD8E4A04B
                                                                                                                                                                                                                                SHA1:D2342EBF52614F1EAFD07BBFDC72E3F65A1963B8
                                                                                                                                                                                                                                SHA-256:483E819776ECFED148800D9E881C1C72F4279D74264B49A38346C26358EF98DC
                                                                                                                                                                                                                                SHA-512:E936442EBA58D4438749791365F38CE7D39B7291F3BB032D35FBB4FAED6AF7E14C9CA7D4FC57A62B90A950C3868AF0755C4530BB5DF8A05CA9FC27044BD522C6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/unplugged_logo/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M6,18h12v1H6V18z M22,6.2v9.6c0,0.66-0.54,1.2-1.2,1.2H3.2C2.54,17,2,16.46,2,15.8V6.2C2,5.54,2.54,5,3.2,5 h17.6C21.46,5,22,5.54,22,6.2z"></path>. <polygon fill="#FFFFFF" points="15,11 10,8.35 10,13.65 "></polygon>.</svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 1035

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1785
                                                                                                                                                                                                                                Entropy (8bit):7.612882265548462
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:UrEVmgu6kaPnJFDwuTblUIyvJTjQIgGt6SamNsg0871W:JVmgu6kY7ffwjQIgCTt7Q
                                                                                                                                                                                                                                MD5:F7E795F2961AE6278904C19E58B4C5CF
                                                                                                                                                                                                                                SHA1:352B1E88A26C2319182A070F37092A46C70B63DA
                                                                                                                                                                                                                                SHA-256:45A953C15A7BA839EBF52DF8FA5657478F7C60FE6835E332C0B688949BDF12D1
                                                                                                                                                                                                                                SHA-512:EAD19CA9B0BF491158E283406382F02CA61CD3919FF0C4C4D1445E6DD06BB226A9A785B034DF0A05C69382A9DE9973DC915719D2ED5CFB9BAAFB3109F16952FB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://yt3.ggpht.com/ytc/AIf8zZQ_iydY9-n5YrxXqueFzbdqIW4mfst6VKB-M03Ung=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                                                Preview:......JFIF.............*Exif..II*.......1...............Google..............................................................................................................................................D.D...........................................4..........................!...."1Aa.q.4QUu....#$%S.................................A..........................!1AQ"24aq.....rs.......$Td.......#DRb............?...(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ".....6_.i..St.$....n<.........d..v.......A..h\G>.4$fN@...-.b..".qH.....u...z...cYI.>*).;........$......A.;.y....N..m....%......fK.I.mk.`.ve.nC1.j..8N~... ..R.R..Fz......4..H>"I.X.x]....feVV..X..9..b......K.u.i 8Tb...3..\.].....@i-....e]w..?...s.=.W.h.<n..H....N....I.w..1^.n@.Z..........9...k.............G.l ...Zw...S..G..'.Y..$.b...V.G.Y(.DJ".O.V..7..Ik..e...w&4.F...@.zV..J.Yhp.8....3.jzJ..Fh.L.O...l............-.F..-....^....Y.Z.N!u........s,q..\. W8......:.H]y..xq.Mas...f\.J.=xg%..9R..@#.}.G|T.m...w..3.....G.hX..BIP.....

                                                                                                                                                                                                                                Chrome Cache Entry: 1036

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):778
                                                                                                                                                                                                                                Entropy (8bit):4.260772867505465
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4tM65jghuamzC41gZVz1QDUQ2R6a2qanGgmonPQ/0:t4tMMjwuamzz1gZLQER6lLmoI/0
                                                                                                                                                                                                                                MD5:C912F19C8AAE23F530DFDDD4D7BBA780
                                                                                                                                                                                                                                SHA1:40C607FABFDE63E2A4D92462FEC123A2D52D1F8E
                                                                                                                                                                                                                                SHA-256:E593ED5B1D641EA4F61CD2308346A608EE088E293AC177881E4CB43969B87E05
                                                                                                                                                                                                                                SHA-512:377D00EF8981C127EB1A573731B1EC22DA072DED23E7D920834C88F280FEFD160885D9EFEF3F8C6B942DB280685ACED73B2D7240ED55FB85947D8180A1FFBC37
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-dislike/v2/32px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M6.15895 20.0023C5.32221 20.0023 4.54031 19.586 4.07317 18.8918C3.30492 17.7502 3.31241 16.255 4.09205 15.1211L4.82045 14.0617L4.14538 12.4963C3.74297 11.5632 3.84031 10.4898 4.40399 9.64424L5.50013 8.00004L5.50013 6.00231C5.50013 4.89774 6.39557 4.00231 7.50014 4.00232L20.0001 4.00239C21.1047 4.0024 22.0001 4.89783 22.0001 6.0024L22.0001 19.1736C22.0001 20.0073 21.7396 20.8201 21.2551 21.4985L16.1368 28.6641C15.9224 28.9643 15.5279 29.0747 15.1888 28.9294C13.4238 28.1729 12.4653 26.2504 12.9234 24.3856L14.0001 20.0024L6.15895 20.0023ZM27 18.5001C28.1046 18.5001 29 17.6046 29 16.5001L29 6.00006C29 4.89549 28.1046 4.00006 27 4.00006L24 4.00006L24 18.5001L27 18.5001Z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 1037

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):12764
                                                                                                                                                                                                                                Entropy (8bit):7.945603769602861
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:eWhfkXUYySkrjdOjfURnU47v0LyRyO53+yJClH6eqa9F2g1KBGErq8Nh:eW4NnuVnU4DRySNJClPmg1KEErV
                                                                                                                                                                                                                                MD5:EC5F0F4AC7A0BAF990F9DE741A6CC6A1
                                                                                                                                                                                                                                SHA1:841191315B4F49B67EFBB1A0B9E1F6A3E9C59B14
                                                                                                                                                                                                                                SHA-256:26C524950B979D4AC92AD75F3A7AF3A79DD5D7F204EF8667C185B08A4605ECB6
                                                                                                                                                                                                                                SHA-512:E84A071CD77BAD0E66DE5EA2DF5FBFBBEB20866A5400E9511561DCD4BDF796D0D5774078CC4E2DDA4536FCC10C8DD3647D16037D4BF2AE46D9718255FE9B5CC6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/421803980_400805985638869_841925490662952962_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=dxne6-2_7YwAX9a6ryq&_nc_ht=scontent-lga3-2.xx&oh=00_AfB23KiKifEIL-BjjBeBd3mfe8ENK2ToVWYFKOPq_KxqeA&oe=65DAA542
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000032060000df0c0000d90d0000350f0000e2150000d11e0000e41f00001e210000c1220000dc310000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................c....,=y2..F..H.....SSPH.E.5..x$M...0...y.#.@Y.B9@V.1..&9.3Qv.2i. t..2.L.E...H\.....,..$..m.Q.....gCd.:g....(.|F...I..2....1.k.J3.d...@.@.@.@.A..........7.H.N..S..Ig..2IP.a;4Y4$.q.M..BQ..2.'@...fY.......IA..!...PaF.....Ny.rU..".T.}c......RsyH X..,Up.$.XWF....F.+.....Zj.);W.f..9.g...r.a...-+.t...^Cp..j.;4... .G...^.L..^W.....a.......{^nwd.C......L&.d..f....l.,..GH=..4r6x..~...qr.q...>..}...M.1.r-.yy;yoG...ct+...^b....eU....x..*o.-VSB.gl......p..g.........C7l.u...r...]Z.9.\Z.c..|r.icO.....!..k.....~5.....E\..k(W.....w...u.cQ.fe:.,f.....V.G&..Sv.<&..`U..../L../.z...4P.z....p....gzy./|n..g.p.

                                                                                                                                                                                                                                Chrome Cache Entry: 1038

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):320
                                                                                                                                                                                                                                Entropy (8bit):4.8695017860270475
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4jN9RotqtWIXWkjRBnmHRLmTCSkeLlzIxfIcHTJ+hu5hTO:t47N9U/vmRR9jRxmHRLkCsL9IxflMwhK
                                                                                                                                                                                                                                MD5:0913F87D10776D31276AD2F0A64D4177
                                                                                                                                                                                                                                SHA1:EF9EA8B47C6243293A187C61708218B1A1F6E0B6
                                                                                                                                                                                                                                SHA-256:4EE171268D505E911DA178827E7EF13A9C7EB1D6F42FD12F430B4621465EA834
                                                                                                                                                                                                                                SHA-512:A583DF01EF03C14B840FB699C36B8591D8386B04D65CAD74E599A4065F1C5456D4974A7DBEF6031E429D2B126A089A582794D78BCFB3F88D91C9394108619D16
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/bell/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.32 1.01 1.03 1.01 1.76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 1039

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):249446
                                                                                                                                                                                                                                Entropy (8bit):5.470579685220208
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:IVyBYOfI26udxTWTcTEDM2j16TcTEDM2ilGb+UPhHo6CmEMDWwyF:oyBzZ3dNo6CFMqwyF
                                                                                                                                                                                                                                MD5:3A9B92C1093DEB1F83F57CE9387856F3
                                                                                                                                                                                                                                SHA1:375489BE5E642B11E62149F791C3DF5C66B6CFBA
                                                                                                                                                                                                                                SHA-256:F5D13C67089BF5CDBB1B349183598BA8DF4DD95A9CF3187E9FD4172F5F5C36FE
                                                                                                                                                                                                                                SHA-512:6588C81876AB2B528C71AC29CB950D5894DCD71C546A65EDFE8AA0977B2588DC6A8DF2B8A55470C44427A7E61869C6DF67A79B37A59A3A0847F8689D276AD051
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/3gwr64x0h4e06b6c0wej9hqsz
                                                                                                                                                                                                                                Preview:!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=105)}({0:function(e,t,n){"use strict";n.d(t,"j",(function(){return a})),n.d(t,"x",(function()

                                                                                                                                                                                                                                Chrome Cache Entry: 1040

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JSON data
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1586
                                                                                                                                                                                                                                Entropy (8bit):4.971538502379734
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:Yj0jutsEgaFs9v8eY2x2UfwhUdt0A66ucXaKUoXab/:Y9ts3aFs90pUbtd79aKpab/
                                                                                                                                                                                                                                MD5:052B9F6B80876F7C32894105E377BA3B
                                                                                                                                                                                                                                SHA1:2018FC66AB3C28A18167B11C547406CF1BBAF89A
                                                                                                                                                                                                                                SHA-256:A7B005C03E9F79AB0D36080925C50F6C101BBBF9853DD849E9A0030A810C89A1
                                                                                                                                                                                                                                SHA-512:2DC6CA28250F1E5A0EF91D677A6732BD64D5D09C930B78AF226823621C0F1A6BDBDE23583C75F69D5101E918D7FAF40ADD7C236B0AA733D3B02F95528D1B3374
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/manifest.webmanifest
                                                                                                                                                                                                                                Preview:{"name":"YouTube","short_name":"YouTube","background_color":"#FFFFFF","display":"minimal-ui","start_url":"/?feature\u003dytca","scope":"/","icons":[{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png","sizes":"144x144","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_192x192.png","sizes":"192x192","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_16x16.png","sizes":"16x16","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_32x32.png","sizes":"32x32","type":"image/png","purpose":"monochrome"},{"src":"https://fonts.gstatic.com/s/i/googlematerialicons/video_youtube/v11/white-48dp/1x/gm_video_youtube_white_48dp.png","sizes":"48x48","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_512x512.png","sizes":"512x512","type":"image/png","purpose":"monochrome"}],"theme_color":"#FF0000"

                                                                                                                                                                                                                                Chrome Cache Entry: 1041

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (10908)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):486798
                                                                                                                                                                                                                                Entropy (8bit):5.57353553633033
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:05r0PfcrnFasY0aSIEyGPcGCmvH29uwgpxz6lSff9XDMl2W+eU7Ow/qTBPci26Lc:0AvJhMwgpXlW+nyTZciIUCUz8QPui7k
                                                                                                                                                                                                                                MD5:9A551377D8D8B68AB3ED78CC982183C1
                                                                                                                                                                                                                                SHA1:02A6C1C98CC2845AE3B0E2F9CE9BD981556B198F
                                                                                                                                                                                                                                SHA-256:58EEF55448DB9DFA88F150891FA7A5425609C50AD60D41A94196872315F3B32E
                                                                                                                                                                                                                                SHA-512:E341F54EA2FC36956B4CA45A96AF8BFB3F7740C6F01FBB6DC086CA95768B2AE8546B24609FC5E76A826D2F44049FAC78099FBEC170470888EF1008FBF545C688
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iiqW4/yk/l/en_US/a9CIW7r0LUeGkn3SpZbsSsrVCiehpPxO1r5U3aG_1V6P1w2TF_zjTjnKqDjeymQ1GKah1m-QatNLCvPbvFcpHZo5jFgIVR4NSd8Jv0Nuruwv9a1i_pdlivXmwa2O3nvkFqAE01U975kCvVo5VdgSV-eRKaWgG9iZI3TVF3bINdSIhPHL0dpVCRBCDkRIDOWfZomugVzXJNekCZ6S34zcHhszLr0G.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometFeedStoryMenuQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7083058335113269"}),null);.__d("CometFeedStoryMenuQuery$Parameters",["CometFeedStoryMenuQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometFeedStoryMenuQuery_facebookRelayOperation"),metadata:{},name:"CometFeedStoryMenuQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometFeedStoryMenuSection_promotion.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometFeedStoryMenuSection_promotion",selections:[{alias:null,args:null,concreteType:"QuickPromotion",kind:"LinkedField",name:"local_alerts_story_menu_promotion",plural:!1,selections:[{args:null,kind:"FragmentSpread",name:"useCometTooltipQP_quickPromotion"}],storageKey:null}],type:"CometFeedStoryDefaultContextLayoutStrategy",abstractKey:null};e.exports=a}),null);.__d("useCometTooltipQP

                                                                                                                                                                                                                                Chrome Cache Entry: 1042

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2434
                                                                                                                                                                                                                                Entropy (8bit):4.737059133849761
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:owOGkjKLAltP84lPMYxznNoCGVShuKJpn2:MLvtPhlPMYFNoAJp2
                                                                                                                                                                                                                                MD5:06360FF211B374AFC9473FAEA2886095
                                                                                                                                                                                                                                SHA1:6E40EC924C7CA539185ADBF78566DAEFEB5B97BC
                                                                                                                                                                                                                                SHA-256:EEA10F57C4E2A6677142FEEC3F9353399D500BE403C61C5456881396ADF6FEE3
                                                                                                                                                                                                                                SHA-512:3F1A3497714CA8C028469439CEF0B1DAE3805B34447CB96BC2C973A7C98F06EE9F75C91D2DC7DB334ACEB7031888727091B9700E1BEFCE71B5C9A431830CEDA2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_round/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <defs>. <radialGradient cx="5.4%" cy="7.11%" r="107.93%" fx="5.4%" fy="7.11%" gradientTransform="matrix(.70653 0 0 1 .016 0)">. <stop offset="0%" stop-color="#FFF"></stop>. <stop offset="100%" stop-color="#FFF" stop-opacity="0"></stop>. </radialGradient>. </defs>. <g fill="none" fill-rule="evenodd">. <path d="M1 1h21.77v22H1z"></path>. <g fill-rule="nonzero">. <path fill="#F00" d="M22.54 7.6s-.2-1.5-.86-2.17c-.83-.87-1.75-.88-2.18-.93-3.04-.22-7.6-.2-7.6-.2s-4.56-.02-7.6.2c-.43.05-1.35.06-2.18.93-.65.67-.86 2.18-.86 2.18S1.04 9.4 1 11.18v1.66c.04 1.78.26 3.55.26 3.55s.2 1.5.86 2.18c.83.87 1.9.84 2.4.94 1.7.15 7.2.2 7.38.2 0 0 4.57 0 7.6-.22.43-.05 1.35-.06 2.18-.93.65-.67.86-2.18.86-2.18s.22-1.77.24-3.55v-1.66c-.02-1.78-.24-3.55-.24-3.55z"></path>. <path fill="#FAFAFA" d="M9.68 8.9v6.18l5.84-3.1"></path>. <path fill="#000" fill-opacity=".12" d="M9.68 8.88l5.13 3.48.73-.38"></path>. <path fill="#FFF"

                                                                                                                                                                                                                                Chrome Cache Entry: 1043

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):338
                                                                                                                                                                                                                                Entropy (8bit):5.081456518478992
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slbWKJAOBUtTxGjxAOyVov2RtNI8MobBWDyewVR2OsXdfDRUEubz5JM:t40rOQojGOsov2fCy9GyekahDRqzc
                                                                                                                                                                                                                                MD5:344BD6131BA252992E7B43DB8ACF0EF4
                                                                                                                                                                                                                                SHA1:AE9762E6C8B2582AC06B72E1056F93394F1E7528
                                                                                                                                                                                                                                SHA-256:F45C028690DE48FA989AA16E372FA580806B168114800CCCF6BF967C1B73C7E8
                                                                                                                                                                                                                                SHA-512:49EE13BAF8D5E0847DDC4CE980F33540EE405784432E6027310224290FC1B9D835B80D8F9C7CE02D5A2692411B9B230BE65FF8DF6F63CCD92287D109673C1888
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_music/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <circle fill="#FF0000" cx="12" cy="12" r="10"></circle>. <polygon fill="#FFFFFF" points="10,14.65 10,9.35 15,12 "></polygon>. <path fill="#FFFFFF" d="M12,7c2.76,0,5,2.24,5,5s-2.24,5-5,5s-5-2.24-5-5S9.24,7,12,7 M12,6c-3.31,0-6,2.69-6,6s2.69,6,6,6s6-2.69,6-6 S15.31,6,12,6L12,6z"></path>.</svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 1044

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1803
                                                                                                                                                                                                                                Entropy (8bit):7.1395058921274375
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:giDiWHN4f/evy2VNo3nlunz2daBhkaMqH0:D8HevVfoXlAzPQ
                                                                                                                                                                                                                                MD5:0085E33561064BE5E6014F1A98E5422B
                                                                                                                                                                                                                                SHA1:29C015313DE9D432E01970287B5CE1332CE20E0C
                                                                                                                                                                                                                                SHA-256:8DA9A11982FD4A78CDD871428216790E090ED5B9C99D7A2AECB5BD1692C55103
                                                                                                                                                                                                                                SHA-512:2CC936353EBD672F2C071FD76F1A1C27451A87D086E59412B20A39C0998AC8A0D746AF7581F37E7F3AC705694AD4103B53DEBC462B5A11C977B8E8FF27B870F3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/325655643_852357862641048_7519470758655921722_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=ibc1JGCuGsYAX-o2LD5&_nc_ht=scontent-lga3-2.xx&oh=00_AfBTGjdLQ0PvosGFnt72C8J2RV5g3E6YI6lEXq5-F6KjDg&oe=65D9F70B
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000e101000090020000de0200002c03000003040000d8040000120500005f050000aa0500000b070000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."...........................................................................................V...'.^/in..e.*5-s.-....[4.E.........pj{~4..b.... ............................!"...........{{......o........K.Tj...3&i.=........J..M/.eL..ed.)\.._.O%pZ..E..kP.khH..V....J.....<.Ob.e...X..Lv.UsY...s..<.".>.,..._.P.OC....!.......................1..!$AQa........?.....[=\k(........n....0)...o..-.t... ........................!1."Qa........?..9..vx\.......|...K.....(.......................!"1A..2Qq#BRr..........?...0:..wj..%..c... ..8.....cZ.xU..`B...Q?.3..zM.......6a.1q..m.n...........^\8B1Ga..f.T..L..L....M7"XgS.. P...a............../..}&#3nSJ.f.\6*e.Dx`.PFn.f8UP/.8.D.zf..q.O...!....

                                                                                                                                                                                                                                Chrome Cache Entry: 1045

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:C source, Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):75995
                                                                                                                                                                                                                                Entropy (8bit):5.330233242624909
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:r1X8E9coqS/zCct2GhRPXE2IbD71SgUeW7vIUncTUDgNpD5qTqGUMIzA:N8+/zCct2GDPXE2IbD71SgUeW7vIUncs
                                                                                                                                                                                                                                MD5:77476E9F4544D16E10921CB9D56067F3
                                                                                                                                                                                                                                SHA1:22677D2DF42EEC873802245EC72BBD8B6896F324
                                                                                                                                                                                                                                SHA-256:FB9B509D020C4C45AD497DE7C4F7D1B22B4E7DC62339927FBF7E32E227932CB7
                                                                                                                                                                                                                                SHA-512:86778E76F67A995D3FD9E4A5A6EDE940F5929A50390D578BD12ABBEEEA8FD94C09C8566C831DD92BB6D13A18ED24CE014416693432DD132207F0972B052C3408
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/727ucpfhmn0jolb3t2h3o5dkj
                                                                                                                                                                                                                                Preview:var _0x41e7=['platformKey','getNavigatorPlatform','productKey','product','productSubKey','productSub','vendor','vendorSubKey','getDoNotTrack','incognitoKey','RequestFileSystem','webkitRequestFileSystem','TEMPORARY','storage','estimate','quota','safariIncognito','localStorage','setItem','test','Firefox','open','onerror','onsuccess','indexedDB','PointerEvent','MSPointerEvent','IE\x20','match','join','replace','OPR','Opera','splice','canvasKey','isCanvasSupported','getCanvasFp','isWebGlSupported','getWebglFp','javascriptsKey','scripts','locationKey','hash','host','href','origin','signalsKey','getSignals','getAdBlock','getHasLiedLanguages','getHasLiedResolution','getHasLiedOs','hasMinFlashInstalled','fonts','swfPath','loadSwfAndDetectFonts','missing\x20options.fonts.swfPath','flash\x20not\x20installed','swf\x20object\x20not\x20loaded','jsFontsKey','monospace','serif','Andale\x20Mono','Arial','Arial\x20Hebrew','Arial\x20MT','Arial\x20Narrow','Arial\x20Rounded\x20MT\x20Bold','Arial\x20Unicod

                                                                                                                                                                                                                                Chrome Cache Entry: 1046

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):57731
                                                                                                                                                                                                                                Entropy (8bit):7.983637455021233
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:lpsrKZyAkRQ06TALi7uEadbjrT9vDWVWvB00u3uRpWcqP5LUdPIpEbRMIx:PsruyArALvpVZDpvSHOp/qPKPIpEbSIx
                                                                                                                                                                                                                                MD5:0C01999E4388A88FBC6086D3B09A6F22
                                                                                                                                                                                                                                SHA1:77E5EE9C6C33B628A797FD8468587C6EF332942C
                                                                                                                                                                                                                                SHA-256:6205C48F4FBBACE22EDF077234E5C870F9B2986FD94135AB44FE27FD7AF4C444
                                                                                                                                                                                                                                SHA-512:5C020CE54F290AC0F192886C845F31CCB13E666F52AAE11B47FC284CCC3798AD0C913CFC152F3464BA6BBCD534584B890FCDEE1466038E85F0ECA70883481CA7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t51.29350-10/428195677_1109317450419007_143687633796581147_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=7K_ufPfRb6IAX8MSQqU&_nc_ht=scontent-lga3-2.xx&oh=00_AfDa49rkJqHzSIFjG8OfxufcNXZo42zGHt0RH-fduYMkUQ&oe=65DA4AB8
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000081d0000ef3b0000b9400000d3460000915d00009d850000e08b000086920000359a000083e10000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................C..I5...Mb.h.M.4..DM9..E0!...b`..j..*.....(........@H...M.d.4.41.&@.`[..`..P..LjQX...(..!..d...@...Z.8B.e.@....ZBp...@..1.Q..&.......i...Q.D.L..4.FQT.....9FV........N..........Q.......@(i.2.4.46..JJ2.&...g(.`(....2..@.....%.......r..P. .euyz...W!;..-gb.~c_g.X..9........h;..%i...f.....id&...H.kZ.k9....&..(..@.....k.$...B`.... &@(....+..FD.1..4..D.r..4..IFK$.N3 ....c..H....eT.....}.G........?......y....,..e4.8.. ....(....&...H..4..&.@...k%%l.R&......e.....}''..F$..^...._....O..^..ig.>..:.96.x...... $....W(.....9..CT..d.4.4I....H..`....b...2.......b.<.*...#.7.......q}..X..[....u..p:..3..y.

                                                                                                                                                                                                                                Chrome Cache Entry: 775

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3977
                                                                                                                                                                                                                                Entropy (8bit):7.862453173327484
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:/JdAwVRth6Rmh6qa+N+KdgYcxPQc77BQQoIk3d5yE3bV3S:B6kRd6fg6zQc77BQQSvyErV3S
                                                                                                                                                                                                                                MD5:4F1EBE8CB5E36D4FAFE61FF39E8D870B
                                                                                                                                                                                                                                SHA1:D6ECB38B4E280907C9B8046EAD13B974A2774905
                                                                                                                                                                                                                                SHA-256:175781ED13DE7359A7D16BBF1C2EF0A81B60CD64DC9A3B2DA35C3CF4B6C153C3
                                                                                                                                                                                                                                SHA-512:790AD0F468F16CBA3BF8C97659CC4421EF4049E4C220F073D6010CFE073653E6AF649358A3F849BD2C0B2ED83D9E3D3FE12360C33A8DDCCACFBC97B5992A7AAF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://yt3.ggpht.com/cexkusY_WDfoU04VaLRfZkPpwaFsopQ43v_g-6Na1U2eO-HV6J1pe3iEx5BI59tqqZou_zOeQw=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                                                Preview:......JFIF......................................................................................................................................................D.D............................................6...........................!1..."A.2Qaq.....BRr......................................;.......................!.1.AQ.."aq.....2BR.......#3br................?.m..!f.......hW&.j.........B.NY.....$Ekz<I.S+}q.K.Fh"ru.]Vu...G..<x?...C..8...UIP.!@........BP.....Rkd....a.+Uk..7.s.>....Uo,ku..].jQ.fi.....$..U..$...N...2L..`:....D....I.<wUn...|.W...=.d....A..@Ya`;.8.y{..{T..,)M.k..#.F....2*}<..E`+....?.>....M.=`.n.f.].Ia...vS+{.P.J....r.q"....v>7..^..JJK.u!.t..e.A.2..8:...6.1.(N....'=....1.../.../...m...{.\r).U1..2cx.I..p..+x.F.v{..q..!..".I3..*......."...25.....zD.Y.;......U.n.U...X`..R.s.....;....ik..T1..*.....-.8.!r9......[....9r.$ L...<.....0b).%.R..........z.m[*.(.EMn....&...I"`.c.)..(..`3..#..v.O;.^.....(....i'........@..igX..Q..<..:......6.nh.JK.K".....7.GF.

                                                                                                                                                                                                                                Chrome Cache Entry: 776

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):175
                                                                                                                                                                                                                                Entropy (8bit):4.966965284633015
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHtRUhVNBz2SVMzLSQQQEK/:tI9mc4slhohC/vmI4LUhVNBz1VOGQQQz
                                                                                                                                                                                                                                MD5:36830448E3F7A1A3A2D487003A091E9C
                                                                                                                                                                                                                                SHA1:5E890C51BC88F472775B79639B6C1FC51F08DC05
                                                                                                                                                                                                                                SHA-256:31264354C77C510E3AE936076B8C10048515F7F6F5B6EE3EC34FD184144DF96E
                                                                                                                                                                                                                                SHA-512:D3AA088237953AC48F2E66B6C3DFBB3A18A11F508E2F2DC650596EE5CE5908D2BEDF2AA01107F0A89DC7B113BBF63C2CB71DA113AD6625047707D3C3E4690F5B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/download/v9/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 18v1H6v-1h11zm-.5-6.6-.7-.7-3.8 3.7V4h-1v10.4l-3.8-3.8-.7.7 5 5 5-4.9z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 777

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):94292
                                                                                                                                                                                                                                Entropy (8bit):7.997545896070056
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:1536:nP3ItXGzd0uzM7WHycx5plCPdwgiduSPVLs3NX5Sm8MiOLh2e8QtHyF3KzsM:nvItqzuWHycNCYsSpgR5ThP8QtSbM
                                                                                                                                                                                                                                MD5:1C190CA823D0E7655A504D23771D434F
                                                                                                                                                                                                                                SHA1:4CBE9381C08EB270DF3C9BA073C93068BFFF16A7
                                                                                                                                                                                                                                SHA-256:3644453E188C84797AE64E4907FCA598033E2177F92B60D8EC5B959DD8181634
                                                                                                                                                                                                                                SHA-512:9E9E385EE4038BA671AC28F1A0396D66BE06FF705927638A7C7282573B7DDA9EE97B8B96DE634A19B216D243D73F5BBECBDB81487EFEDF305CDE62CF03D33495
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/YAV3Oh8KaV4/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLAZuAVYYfF4SBumF3brycJbkon7wA
                                                                                                                                                                                                                                Preview:RIFFLp..WEBPVP8 @p..Pa...*....>Q..D#.."0...p..j@a...".d.=. .....F0...#(..N......'.u....z..g...............X...~]]..../...?....^._._.../........9....................._........}.y.s...?...?........%.?.G..t?.....a..........=......;.G.....O.....}v.q.....B...'..................w.....~.?.?.z......'....~.z.........?....#...O._.E.u.3...?t..............I~l.....[./..._.?.~........'...................?....Y..........7..........m...K.k......r........../.?......w...G._...................m>.?..v...G./.......}....Q........W._........nD..%a......J.U..d...Y...B.$P?>.....T~...A._Z.....;...F...pCW....n......L-..........Lx.._E...|..;.P9..S.;.......zE:....M..).nf...:%P,]._...h.A.X....U..cl.{..c.+......m...:..I...1.......-.F..@.s.r.....b..0.r..9...).5x.....W..I...K....&...n.$...*..3.L.)H.6'....'...(C#..)8.=M...8.xhv..%.(../..{9.)_.i...$K..>x<k=w...X.e....2.........0.,.Ps.p.U..8Q....mE.d.....~.Mn&.D...~S.45..g....@.....$H[...)eq.....Y...]..^.S.>.o.~HI....eq....\kL*.8./

                                                                                                                                                                                                                                Chrome Cache Entry: 778

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (663)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3238
                                                                                                                                                                                                                                Entropy (8bit):5.387809520815037
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:o7BOsUSmiHXpkgcKmdNQ8jsetptY2PfygpcaNQJpSN9KI9hGKb1iqyBKAErw:oE07udO2F5caNQJwN9KAuezw
                                                                                                                                                                                                                                MD5:6B5509EDF491407D765B9248417B3F68
                                                                                                                                                                                                                                SHA1:5380993E0C0CFA67982B78BD17E283625EE0E77A
                                                                                                                                                                                                                                SHA-256:F9D2DB8058E0E3CCBEA9FEA1551EE4D9ECFDBD010E10A9922B9389CCD2F13F31
                                                                                                                                                                                                                                SHA-512:EE9962EA56BE934771649D7157CD7D86933EF07C3813D5C5C962E2D3F5DC53D9F6502D9B2BE24B389E7CB48BF458E8A7E5962BC1FCF283381507724FFCC60989
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var $v=function(a){_.I.call(this,a.Ha)};_.B($v,_.I);$v.Oa=_.I.Oa;$v.Ba=_.I.Ba;$v.prototype.YM=function(a){return _.se(this,{Xa:{eO:_.Hj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.uh(function(e){window._wjdc=function(f){d(f);e(BDa(f,b,a))}}):BDa(c,b,a)})};var BDa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.eO.YM(c)};.$v.prototype.aa=function(a,b){var c=_.Xra(b).Xg;if(c.startsWith("$")){var d=_.em.get(a);_.Vp[b]&&(d||(d={},_.em.set(a,d)),d[c]=_.Vp[b],delete _.Vp[b],_.Wp--);if(d)if(a=d[c])b=_.re(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.Lq(_.jda,$v);._.l();._.k("SNUn3");._.ADa=new _.qk(_.vf);._.l();._.k("RMhBfe");.var CDa=function(a,b){a=_.rqa(a,b);return 0==a.length?null:a[0].tb},DDa=function(){return Object.values(_.So).reduce(function(a,b){return a+Object.keys(b).length},0)},EDa=function(){return Object.entries(_

                                                                                                                                                                                                                                Chrome Cache Entry: 779

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (826)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):8035
                                                                                                                                                                                                                                Entropy (8bit):5.326159900569122
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:scBpCBhS6OycT4w9uTEs/tQ7x09fih6axjOrFBh/ZQxKY8X2UBYRMwtRdB:/fEw9uQsamojEFBh/WxhB
                                                                                                                                                                                                                                MD5:FDA114F94E54E698B9F2916A3F0046F0
                                                                                                                                                                                                                                SHA1:5E14300C2D580CEB721201B14C19A858734EB2D7
                                                                                                                                                                                                                                SHA-256:0833BBD2F41E11AD56CAD5E1E52CCDAFB40F3ABB8D71CB3C8B777455DFFEA95A
                                                                                                                                                                                                                                SHA-512:008E7B7CD839C1B3BFBBFBEF6A5046BAE979FE95A5400CA45765EB74E94594505BB62C42A4F289B86D2B525919884B8B807A025C6C9E4FF43399829E201913E5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.qLa=_.y("wg1P6b",[_.Dx,_.Gl]);._.k("wg1P6b");.var m0a=function(a,b){b=b||_.Ma;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);0<g?c=f+1:(d=f,e=!g)}return e?c:-c-1},n0a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o0a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n0a(b,a)},p0a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.zg&&!(9<=Number(_.Gg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a||a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n0a(a,b):!c&&_.nh(e,b)?-1*o0a(a,b):!d&&_.nh(f,a)?o0a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Zg(a);c=d.createRange

                                                                                                                                                                                                                                Chrome Cache Entry: 780

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3069
                                                                                                                                                                                                                                Entropy (8bit):7.838506061476689
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:KythRwLjWECczHFstYjzf/Wp1lfLV2A5V2409wxyCsT6WVikYt7qX8+Aa7QR:KylJECYlstCHWp1Nf5VR0QsOeJaqXQcC
                                                                                                                                                                                                                                MD5:E22D0643EBC75F0CE6D76E06415ACC4F
                                                                                                                                                                                                                                SHA1:A12C7E2BF1B4C419C72E31200A3D91A96B53D2F2
                                                                                                                                                                                                                                SHA-256:347822859B9085B560094BA55113BC844D637A4EBE5755B88D59360CA8CE5162
                                                                                                                                                                                                                                SHA-512:B9686F455669CEE9E165535C60AE8714EAC7EA97DED812A4EFFB534DBA3461A5044B6B1D8A66BE6BE94B825731F5192EFF95CF30EE3BE11E8DB6D03B4B76C619
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://yt3.ggpht.com/fTbDZB5J9RUfnspwzbrB_XCT_ZdQG2LAjEBtLlnlZ-P41SkHLKur_Polr_ikFiAXTTCM56uIGw=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                                                Preview:......JFIF......................................................................................................................................................D.D............................................5.........................!..1."A2Q..#$Baqr....RT...................................3......................!.1.A."Qaq.......2...#r.BCR............?.s..2..V.t..%t.&w8.n'........P.Tk...b.wq.....,Dh..g,.....S.O..=..59.....=y..v.lui..\.1....)RG...M.S%o..n..&'N.V.I....$g#.........pz)...a..q..-K...'..^.%.9.ru...H...^z..T...m1S....q. ..1....).(~.R.`..-....4.$D..\...L..|..\..a.q...x.|...}............OZ..A.c.Va..<.&.......{.G..^....z..Q..^....u.]Z(.I9..Y|...._.....c.>Bs..I....w.(.........".1.RU.....`9.J.w[S.....EO...)f....*...qg....c..%...{wu....Y.q..b......0B.3o.NJ(.w.@j.n2.P..W.H.l...N..$l.-s.KOul.fJ.`c.R.X..L.U..s.]N.eVS..$DEN.]...Ki$..HR..[,w..GDI&...%......<...9.Vtn.vm..%G..3\.M_...#..P.,..H.#'.J...=-).^.....B.Q...._...;..Q....K]....t.Q/....U.{.j*..

                                                                                                                                                                                                                                Chrome Cache Entry: 781

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1998)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):164119
                                                                                                                                                                                                                                Entropy (8bit):5.620202021115585
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:rvX5Lw5UlDJVZHL08oy6CiEETgDAGXoY7xZSrnCvnxtsmEtn4DtATIcT3PY0AU:rvX5LKUlDJVZHL08oyRiJsD7oYb/sHnh
                                                                                                                                                                                                                                MD5:1904AE48D0334CE16D0DE8B2E3975144
                                                                                                                                                                                                                                SHA1:9312BE1FC2ADD82B36A058BD6426811CAE3F7546
                                                                                                                                                                                                                                SHA-256:27D9ED2AAD0901B3BCCCB194ADD5BFF90048EB8DA5A5DC09FB1514A6182E0866
                                                                                                                                                                                                                                SHA-512:4DBADCC2FA29702B8D2FA7C854F116E64FE5B22EC5EC0F7A8F9BBB50D9461096EB5E012D5E1C0D88C14DEC4AD23677EB0EC46C3B9392A8B64608C55DB275891A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.js
                                                                                                                                                                                                                                Preview:'use strict';var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ca=ba(this);function da(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}}.function ea(a){function b(d){return a.next(d)}.function c(d){return a.throw(d)}.return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}.f(a.next())})}.function r(a){return ea(a())}.function fa(a,b){a instanceof String&&(a+="");var c=0,d=!1,e={next:function(){if(!d&&c<a.length){

                                                                                                                                                                                                                                Chrome Cache Entry: 782

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):218
                                                                                                                                                                                                                                Entropy (8bit):5.088157969445009
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4SDJhK+WkjWp2IGLb:t47N9U/vmRWhKdkjs2db
                                                                                                                                                                                                                                MD5:46911EFE9CA3F93489D0C1927BBD5B98
                                                                                                                                                                                                                                SHA1:A587985F1FD3DC99B495BCC620E2351F9BAA13E2
                                                                                                                                                                                                                                SHA-256:B202492060B933CE3BCD93EED56F46AB442C61ACBBA6D4C47921417A06439096
                                                                                                                                                                                                                                SHA-512:AA70F29C404DF62CCC4514ED432B4315E423FFEF7AB79DFD8985C58909CFA6263EE5F2A8D0A251A4BF0ECB491C9A39D6A6E2A99307A4A75F910530F60633023A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/message_bubble_alert/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M13 14h-2v-2h2v2zm0-9h-2v6h2V5zm6-2H5v16.59l3.29-3.29.3-.3H19V3m1-1v15H9l-5 5V2h16z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 783

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):593
                                                                                                                                                                                                                                Entropy (8bit):4.524151373929859
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRGtKL62ZG3XcZsRq6JoNiLrRKMszLgWEajiexYNjbv:t4jU/vNKLgXc6RqCKkE+qTCn
                                                                                                                                                                                                                                MD5:CD203C4E6B3788438827E21F28380A98
                                                                                                                                                                                                                                SHA1:374FE8D0C91F9C94E8FEDA631E20D11C55E1C9B0
                                                                                                                                                                                                                                SHA-256:396B1892EBAA72D0874C8D0A3AFB87B803560058D84FAB6A29761A4D6238F8ED
                                                                                                                                                                                                                                SHA-512:2E4278A0355E84888561BABF3D0FDABD29AEF0FEFDA84199E794D4CBFC6E01FEEA9C0E91F5EC521E0197F1569788FD36DFC2A0F0BC7186A4D805EB8A9763579A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/broadcast/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M6 12c0-3.31 2.69-6 6-6s6 2.69 6 6c0 1.66-.67 3.16-1.77 4.25l-.71-.71C16.44 14.63 17 13.38 17 12c0-2.76-2.24-5-5-5s-5 2.24-5 5c0 1.38.56 2.63 1.47 3.54l-.71.71C6.67 15.16 6 13.66 6 12zm8 0c0-1.1-.9-2-2-2s-2 .9-2 2c0 .74.4 1.38 1 1.72V22h2v-8.28c.6-.34 1-.98 1-1.72zm-9.06 7.08.71-.71C4.01 16.74 3 14.49 3 12c0-4.96 4.04-9 9-9s9 4.04 9 9c0 2.49-1.01 4.74-2.65 6.37l.71.71C20.88 17.27 22 14.77 22 12c0-5.52-4.48-10-10-10S2 6.48 2 12c0 2.77 1.12 5.27 2.94 7.08z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 784

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1011), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1011
                                                                                                                                                                                                                                Entropy (8bit):4.958228722086236
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:WybE3QpQgbgbGNKOkhOXO6FOXOWOvOOpx+FUDx+W:WybEgpQgbgbGNNlOOpx4UDx+W
                                                                                                                                                                                                                                MD5:5306F13DFCF04955ED3E79FF5A92581E
                                                                                                                                                                                                                                SHA1:4A8927D91617923F9C9F6BCC1976BF43665CB553
                                                                                                                                                                                                                                SHA-256:6305C2A6825AF37F17057FD4DCB3A70790CC90D0D8F51128430883829385F7CC
                                                                                                                                                                                                                                SHA-512:E91ECD1F7E14FF13035DD6E76DFA4FA58AF69D98E007E2A0D52BFF80D669D33BEB5FAFEFE06254CBC6DD6713B4C7F79C824F641CB704142E031C68ECCB3EFED3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/cssbin/www-onepick.css
                                                                                                                                                                                                                                Preview:.picker-frame{width:100%;height:100%;border:0;overflow:hidden}.picker.modal-dialog-bg{position:absolute;top:0;left:0;background-color:#fff}.picker.modal-dialog{position:absolute;top:0;left:0;background-color:#fff;border:1px solid #acacac;width:auto;padding:0;z-index:1001;overflow:auto;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-transition:top .5s ease-in-out;-moz-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;-webkit-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;transition:top .5s ease-in-out}.picker-min{position:absolute;z-index:1002}.picker.modal-dialog-content{font-size:0;padding:0}.picker.modal-dialog-title{height:0;margin:0}.picker.modal-dialog-title-text,.picker.modal-dialog-buttons{display:none}.picker.modal-dialog-bg,.picker.modal-dialog.picker-dialog{z-index:1999999999

                                                                                                                                                                                                                                Chrome Cache Entry: 785

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):219
                                                                                                                                                                                                                                Entropy (8bit):4.761347757859317
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4T7HVaar7D93JnGLXeSV:t4noU/vmRT70arpUXNV
                                                                                                                                                                                                                                MD5:366B82D23090B2A9BA414E77922CE82B
                                                                                                                                                                                                                                SHA1:1EC32038785C0B7E0591E910D0BCB5BDA337F37D
                                                                                                                                                                                                                                SHA-256:BF44FEFE6CEA80E391078F4DC8DA39A1CC34704B2B88F2D6402E3CA9F6DCFA47
                                                                                                                                                                                                                                SHA-512:2DD8EE2C7DBD8CD86C99210C733B33CDE0FD32CAF813E55A74E4C007241CC261EF32B3C091924AE735C50D9A4C80E82DCC38FA643185BF0434B57005C5FAC6F8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/check_circle/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zM9.8 17.3l-4.2-4.1L7 11.8l2.8 2.7L17 7.4l1.4 1.4-8.6 8.5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 786

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (65405)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):8645939
                                                                                                                                                                                                                                Entropy (8bit):5.617857652883011
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:49152:YSxZhSxBqluGy/pk/VfZ3q++vIkrF+141ZG1nXixF5ikTbaX3cmQAe/otm/H73do:QM3IIkxxFAkcdTob9LU
                                                                                                                                                                                                                                MD5:69998E173B8C146479488BD8D7FBFAB3
                                                                                                                                                                                                                                SHA1:D343051522769F5C16586F6A67E045D830433597
                                                                                                                                                                                                                                SHA-256:CC3EEB6E34A2DB5A5B28937DA61F6EB2BB56B0DD2EB1E26D0EDF2F97450C41F2
                                                                                                                                                                                                                                SHA-512:9C37EF552BEC6E3D0133AD1A38CA422F2BC35AA0361215AD73D6244B8087761859F7F02202F2E119AA260DFF60941CAA48A3A818693952E2290408B1342CD979
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/desktop_polymer.vflset/desktop_polymer.js
                                                                                                                                                                                                                                Preview:(function(){./* HTML content inlined from HTML import */.const d=document.createElement("div");.d.setAttribute("inlined-html","");.const finalStyleText="html:not(.style-scope) {\n --primary-text-color: var(--light-theme-text-color);\n --primary-background-color: var(--light-theme-background-color);\n --secondary-text-color: var(--light-theme-secondary-color);\n --disabled-text-color: var(--light-theme-disabled-color);\n --divider-color: var(--light-theme-divider-color);\n --error-color: #dd2c00;\n --primary-color: #3f51b5;\n --light-primary-color: #c5cae9;\n --dark-primary-color: #303f9f;\n --accent-color: #ff4081;\n --light-accent-color: #ff80ab;\n --dark-accent-color: #f50057;\n --light-theme-background-color: #fff;\n --light-theme-base-color: #000;\n --light-theme-text-color: #212121;\n --light-theme-secondary-color: #737373;\n --light-theme-disabled-color: #9b9b9b;\n --light-theme-divider-color: #dbdbdb;\n --dark-theme-background-color: #212121;\n --dark-theme-b

                                                                                                                                                                                                                                Chrome Cache Entry: 787

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):67991
                                                                                                                                                                                                                                Entropy (8bit):7.9849985713226275
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:kEHobCkpdd3cyZY19RED35DjPqv3m6Z9kHuv1hcpuxYB8:k9N/3Fbb5DjPqv2zOtSuie
                                                                                                                                                                                                                                MD5:99DDEE70BD9EBB8664ECC2009F2505B5
                                                                                                                                                                                                                                SHA1:A1E3FF31E82AAF840972B299CA4FCE816D050696
                                                                                                                                                                                                                                SHA-256:334A0377BD683052CF39F44BDC8EDA422F6CDEDA1DDD4256F02F554D6F39E049
                                                                                                                                                                                                                                SHA-512:C37CB2D803424192491F81FE2459401BE735BD9645450A292E4443CB20D5C7E1BCFD5058F961A305C25EF78BA0B2A61C0458F899E541253ED340330EB7816221
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t51.29350-10/427898121_1062338948389915_6324101907629174511_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=gce-Pd6KvIsAX_QLAy0&_nc_ht=scontent-lga3-2.xx&oh=00_AfAwjTWrgVMUzFSCz7yCq8cgMdS1cJmK2ESkTlzEKEC0zA&oe=65DA3E42
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000ca1f0000824a0000fd4d0000d9500000f771000073a50000abab0000d2b0000096b5000097090100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................3...rPx..X...<..P.I..M...j.N.....h....9.I...'H..i.Z3..RHI!.2...I...d$..!.!$...HN.I0..28K...L2`..D.....;:.s..~8.V..<]..2\.^.....V...N_..iz.V.`K)..v.d$...t..L.&a.!..6.Y&C.C.H..:d;..QG*.P.C.2.,..iN.V.l.WHu.....a .SD.Z.$..gB^..[OB3....3...;=&v.:.I....&.H..C`.S&..(.J.&..m.I...:g83.=.G..u..Os.<..+..V.F...&...x.......F'@.0M5))..3.vtwd$.)$.$.$&v.;K..&t2v...d..*.E.....E.$.........j=.i.C......4:.+.1..tX..)g,....s6.....+.9.SF.^.t.$..$.d..*x..2...4...HL.$.Qv.3`m4...'a.4........f.x..^.R..C.."....t7$..F.g..........2@tD..*t..$..IH...HI!$.I!..*I.d.a..a.X.3....$'g.:*4.@F.R..37..pu.S..fK:&G]..>..

                                                                                                                                                                                                                                Chrome Cache Entry: 788

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):218410
                                                                                                                                                                                                                                Entropy (8bit):5.4575963182002
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:+mgr4xMzGg6HZWP0A7kNA5mz6iE80+7x6oSdw4nhPaJRCdae4pl:BgM6qgHP17oV7xBCAeKl
                                                                                                                                                                                                                                MD5:B272CF1E84669C7B811CCC5BAE20A927
                                                                                                                                                                                                                                SHA1:2F7E34C107EE1BFBB259CF9DD59A78BF37F79B9C
                                                                                                                                                                                                                                SHA-256:28CC67C2528066E543A8E2C8716148503E98B1987536CEAC3F1B9DA5043B7038
                                                                                                                                                                                                                                SHA-512:D29FD72E2B6774BB3CA2B423A1D09058057FC2F5494AAE740B0EF6EDD1A9FF9C5542B899E7379DCF8B3499643276D39724BB2CCFD0B029C30710451F02543C37
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.J6zlSvuPGsg.es5.O/am=P2CJlmMBEISZlnP-nnFyGAAAAAAAAAAArAHs/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlF3Cfl7IHjwI9Q-7RaWlqzKEDZ7Xw/m=_b,_tp"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x1689603f, 0x1040058e, 0x27396998, 0x1c9c67bf, 0x18, 0x0, 0x1ac000, 0x3b, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Ra,haa,Za,bb,cb,db,eb,iaa,fb,lb,jaa,kaa,pb,naa,paa,Eb,qaa,taa,vaa,Pb,Sb,zaa,Zb,Daa,Haa,Iaa,mc,Jaa,Maa,Naa,Paa,Qaa,Raa,Saa,Wc,Vaa,Uaa,Waa,dd,bd,Xaa,ed,Zaa,hd,nd,$aa,aba,xd,wd,gd,Sd,hba,jba,kba,lba,nba,oba,Od,qe,re,Ae,Eba,Ne,Gba,Oe,Hba,Jba,Lba,Pba,Qba,Rba,Sba,Vba,Xba,aca,bca,fca,pca,lca,rca,tca,uca,vca,yca,Aca,Dca,Eca,Fca,Gca,Hca,Kca,Nf,Lca,Mca,Oca,Sca,Tca,aaa,Uca,ag,Vca,cg,Wca,Xca,fg,Zca,hg,fda,jda,ida,qg,lda;_.aa=function(a){retu

                                                                                                                                                                                                                                Chrome Cache Entry: 789

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):259
                                                                                                                                                                                                                                Entropy (8bit):4.710851372205651
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4zmgwDe4btnRm31IE2l0kjMswple9SY:t4noU/vmRzmgw3tnRm31IEURwpY
                                                                                                                                                                                                                                MD5:AA228455232ACB0A6378FED3354869AB
                                                                                                                                                                                                                                SHA1:3447461B1713396150ED0DB5067AE45BFE9F024B
                                                                                                                                                                                                                                SHA-256:1C594744993B086F8C4D3ABE3A4EF2794F1D1BF0D680A354EC0561AFCE427140
                                                                                                                                                                                                                                SHA-512:CE2D4D2D8204EEB68E702F71D87B56CE970B4ACDF547AB20FA4A8B281C655FF41BC175A7949F6B453D7ED4A7EF8DE28C2B6774A67708DB8B7047DB3DFDFC2991
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/add_circle/v3/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17 13h-4v4h-2v-4H7v-2h4V7h2v4h4v2zM12 3c-4.96 0-9 4.04-9 9s4.04 9 9 9 9-4.04 9-9-4.04-9-9-9m0-1c5.52 0 10 4.48 10 10s-4.48 10-10 10S2 17.52 2 12 6.48 2 12 2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 790

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):120
                                                                                                                                                                                                                                Entropy (8bit):4.568105614797637
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:bh6G3XWZNDrMyMcbtugSUhdei3XWZNDrMyMcbz1h8FfY:bnXS5JtpnS5JZh8Fw
                                                                                                                                                                                                                                MD5:D101838E73B156A21EA1FD94EBCEEB1D
                                                                                                                                                                                                                                SHA1:C515B856E4AA0DE6FDAF13536873AFEB0D44D45B
                                                                                                                                                                                                                                SHA-256:01E64CF9DF1DBF2FB4BFA333E3B2838272081B0BD396AACF340A56FA9252E15D
                                                                                                                                                                                                                                SHA-512:A13AA569E36F3C68585965FDCC5B54454264E9EE7CB1BAE695EDF70F0716EA6D71D3E0060B39074BD1EA0E5AE9946B8A1CDF80E7A52BEE1DC8CF8E8E2FE79324
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkbMnFS9SzlUhIFDYOoWz0SBQ3Fk8QkEhcJsA2cf48--pcSBQ14bxIZEgUNxZPEJBIQCXIJePU8PqV8EgUNvYWDDw==?alt=proto
                                                                                                                                                                                                                                Preview:CiIKEw2DqFs9GgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCiIKEw14bxIZGgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCg8KDQ29hYMPGgYIARABGAM=

                                                                                                                                                                                                                                Chrome Cache Entry: 791

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 405x720, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):9352
                                                                                                                                                                                                                                Entropy (8bit):7.979786437230296
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:I7ZnDVimDgJhK8S9SRn/8k85V6HN9dUj8mskDpI62gPKu2JXdx:I7ZnDVhOhK8RukF/dc8mzDpI6JCvJtx
                                                                                                                                                                                                                                MD5:66BFC0840324B9FE113FC4B024AEB1B7
                                                                                                                                                                                                                                SHA1:EA9B1BD76A05046082D64D031C0698CD6741A3FD
                                                                                                                                                                                                                                SHA-256:70B3B269185FAA40F83663E78B288E09A0E15E4252937293ABB56DFAA4A8C1D8
                                                                                                                                                                                                                                SHA-512:B80B1F4F5D36054438CB6163CA719A344166362326093D01B5C39BE8DC1A5103B219E30DE4C21C373E4D1F07B63B85CD78E34F390F3FA53F88EEFDE048E533CD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/MWwDDED3_7E/oar2.jpg?sqp=-oaymwEdCJUDENAFSFWQAgHyq4qpAwwIARUAAIhCcAHAAQY=&rs=AOn4CLB6aAjN7HmTScH5DI3coCJDKlDmCw
                                                                                                                                                                                                                                Preview:RIFF.$..WEBPVP8 t$.......*....>Q(.F......y....g:.Z4as.....7..'...:..N...Kw.&7....R..F>+..<.|...:.w........./.....|......om....l..(...t...U.........n...t..).Y..K..iX.....gn+.elq\J1[y....... ...o6.m.....,y../AdT=.G(...r....)^_J.g;YJ.T...m..m.2.c....0."....j..[?..#:Z..;.k........B....b.]:..z?..U4..].|J..r.....i.........{.k.3B.&@l..p.L$..e..w.}...ut.$..z.i*I.?....(.>..[.......0%+..&*P.S..(..r ....4'_.u................o.......&.......E..|..2..j.....3..9...'.m1..,m...#........5!DZ...QS....)#.u.$M....q......Wt.._D5>.....)..).....36i.....s..4...-.[.4...GU.`..G..4>f.r...W....>:..9.p.....6.G\.[i:.w..?#h.U......[k@..!../qn..=.|...}..|....`"..P.Q.$ ....P.t..J.3Sa......D[....s...RM...5.o.LQ.{..W..^6...lu........*......V[...;_2.$...'&....o.q...d..$/.}O.,4...j..~.w......3.|.^..Y.3.>.....CVu.R......@..7^d`....^..K....`.l......#D..gS...@........[.%`.....`.../._7..../...#.....t..AB.6zZ...k....N..6y....;J....\....IzF......1...A...Y.-P.<..`.=..m./........

                                                                                                                                                                                                                                Chrome Cache Entry: 792

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 512 x 512, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):4094
                                                                                                                                                                                                                                Entropy (8bit):7.606626639912578
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:sJOZYCFHZyLOmhuZ9pG3akQCaNdLvu1V/YQ2EmzraKL73mA:0mZsOmhu18akug1VwrESaC6A
                                                                                                                                                                                                                                MD5:AE541934FC33DF7FD19519B089CE5FF3
                                                                                                                                                                                                                                SHA1:850BD0BD8022BD7D33909674A29042F9D15CA88F
                                                                                                                                                                                                                                SHA-256:52997EDB411EFC192F0E9B460CD9CEA141FDD8833F554CF20F2B4480752BAD8D
                                                                                                                                                                                                                                SHA-512:5731E2AE114E0BE970886DCFC9309504F63A159BECDDC7829858CDD1F22176EB35A51FFD285455B7A48A920A3C356FF10593D11907FE633BD17BD1078DFA709C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/web/shortcuts/explore_512x512.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR..............$.....PLTE...................................................................................................................................................................4tRNS. @0.P`.......o.._.. ...1.A...!.p`....qpQ....aO..a.1......IDATx......... ...`.T.[.........................................................)m9..~@.............q.en....K;=..+..Av.c..0.g...@.T.B|J.R..,...)....~.3.emd.@.$.y.+...~....!.k.3.t...\.........{.k.(&....W..^..6k...W.........G0.'.$...6..)e.R...2,...c..>.....Vih......8~.b..D..O.;.c`.C|....d.4.q..?.V.m.bl:.4..Y..T..Nhs....3..N........^.o..j............86.$..[..9......k`.}....g.XE.=no.].z...............\.p.5...n...$..f..........heE..e.*./A;.......(.T..B.t.N.T....S@]...4..."./...O..=r..u....O..d...d[........xu)....b1].SM!@.O...h..|...DS...Z.@'W......>......1..2....U..(.u;W.......7.....4,j...W....Z.0...r.....[.vj...w...R......3..)8z.i.|w. ...>...2 .~.m...Wg..{............j.b.A....}C`.P.~.....pp.Yl

                                                                                                                                                                                                                                Chrome Cache Entry: 793

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):12486
                                                                                                                                                                                                                                Entropy (8bit):7.927830348812957
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:7FOV/+WV7YOfeBDcGb/2rdN0PxJZJAOqAFHD:5OV/z58Crf05zE0D
                                                                                                                                                                                                                                MD5:E7299BF233797CB6DB7F5E5C4F60B8F7
                                                                                                                                                                                                                                SHA1:1C9D139F6297322FA851D904A8846E0F75DEC345
                                                                                                                                                                                                                                SHA-256:385CB2161A2C24528A041A522B8AFCB356CE0E0E0C9BB3D02B87BA4AFF1521D4
                                                                                                                                                                                                                                SHA-512:18B78B4CAE9FE52407038728DDD3E4B6647CD31BFC10BFF029E58CAD1F92BD4EACD3AF451B86C15C99C78A0AE594E307BBC0C8922EA31DA53BD7ECCADD5ACA36
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426294730_2077624149278674_879459938867030875_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=EDsAD8iInKwAX8muqA8&_nc_ht=scontent-lga3-2.xx&oh=00_AfDrneE1047tQqNQnqNm_vntCosVBLHALRIcg_9p17nJGw&oe=65DA8FCC
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7101000015060000090d0000610e00007d0f0000b51600006e1f00007f200000cb2100000a230000c6300000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................................................................................................s..."......Q<<W....y..y{.../..e,.u.;..wM..9......O2.M<.=4. ..<.=4. ....O2.M<.=4. ......N....H.H.H.H....pW.... .A.%5...m.....`..+...DUR....n...ab.&.!...h5....k.....a.>y..c.\..x...[.S..r..q..7...U6LL.Mh.}P.....jK8.:.S?..EV.."}_.}..:....e5.....c>.....m.qE.......'..=../..gC6....r..sG.d.5.3-.jk...Q;..5}.y..5e;.Z...8.vt;.......]T...k.H...1...[\e.#e.....9mg.../=.?t..0....e.v.v....y..J\..in....n4.c....\|....kc..G.t.ni.a-3....6z.....+.6...a.`G.O.WB.b.S...^^t..I^_>.l06.z.D.l4.....z.w.n)..T.....o.....V.c.............6..

                                                                                                                                                                                                                                Chrome Cache Entry: 794

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:exported SGML document, ASCII text, with very long lines (1120)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):5598
                                                                                                                                                                                                                                Entropy (8bit):4.293279469529671
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:04JsH5RGMp9UC96s4AJu4m35PznhTJAxfxZN0rDRMW8R0aaQWD3rKivMt:0ai9UCgs4AJ/mpzcNx/eMw1QWD70t
                                                                                                                                                                                                                                MD5:2FC13E5E6B51277D7A39CD7AD7D14158
                                                                                                                                                                                                                                SHA1:0C9A5C613E5B853376CF2B96D8501EE5960D09C9
                                                                                                                                                                                                                                SHA-256:9073602654785DE3537C4AA85E69847A0BDC871F8DAECB053C7698D4AFE8F6DE
                                                                                                                                                                                                                                SHA-512:A1F8493CFC4F9C619785D9E39F0E9A54420643C3905193E6D5FFD7531184CA5E5B0FE1B43E7307506ADC01CBB397E4A1CCEA63ACD37304360AACAD8FF06D6DB8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/yt-logo-updated/v2/24px.svg
                                                                                                                                                                                                                                Preview: LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id="yt-logo-updated" viewBox="0 0 90 20" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg">. <g>. <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 3.12323 0.597366C1.89323 0.926623 0.926623 1.89323 0.597366 3.12324C2.24288e-07 5.35042 0 10 0 10C0 10 2.24288e-07 14.6496 0.597366 16.8768C0.926623 18.1068 1.89323 19.0734 3.12323 19.4026C5.35042 20 14.285 20 14.285 20C14.285 20 23.2197 20 25.4468 19.4026C26.6768 19.0734 27.6435 18.1068 27.9727 16.8768C28.5701 14.6496 28.5701 10 28.5701 10C28.5701 10 28.5677 5.35042 27.9727 3.12324Z" fill="#FF0000"></path>. <path d="M11.4253 14.2854L18.8477 10.0004L11.4253 5.71533V14.2854Z" fill="white"></path>. </g>. <g>. <g id="youtube-paths">. <path d="M34.6024 13.0036L31.3945

                                                                                                                                                                                                                                Chrome Cache Entry: 795

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):15744
                                                                                                                                                                                                                                Entropy (8bit):7.986588355476176
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK79/:p7EJ5E2bJwi5jLwK79/
                                                                                                                                                                                                                                MD5:15D9F621C3BD1599F0169DCF0BD5E63E
                                                                                                                                                                                                                                SHA1:7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
                                                                                                                                                                                                                                SHA-256:F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
                                                                                                                                                                                                                                SHA-512:D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
                                                                                                                                                                                                                                Preview:wOF2......=........t..=..........................d..d..^.`.. .T..<.....|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

                                                                                                                                                                                                                                Chrome Cache Entry: 796

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (3274)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):456327
                                                                                                                                                                                                                                Entropy (8bit):5.428776406641289
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:i7gniZbz80T44cQr9yTkXsOMlZITy+AEJO9F0n6Kl84JCLq16LbrdzNmi:iph9yTkXNMITyRf0nCBq1S1
                                                                                                                                                                                                                                MD5:01793D4DABC2DCCECA0C4EB8D602FCD8
                                                                                                                                                                                                                                SHA1:D2031142EC198D3B024A42BC29F52EB966D2E3A3
                                                                                                                                                                                                                                SHA-256:73E10F4BCFB6E3F51820CBEAA4341E87E6352DD5484562EB8FB2D5C5876F9BA3
                                                                                                                                                                                                                                SHA-512:3C7A9E012B5D13C16486E47143E996B35176489EA31A9FA6F7B2A095A1FE55E33521594AF2C8DE717A94AF9FC4420A2BC7DC6C2D6802B23E47314BB015574D7F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3i74t4/yZ/l/en_US/93oQxiZgsu0.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometSetDenseModeMutation_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="4486145264820781"}),null);.__d("CometSetDenseModeMutation.graphql",["CometSetDenseModeMutation_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a=function(){var a=[{defaultValue:null,kind:"LocalArgument",name:"input"}],c=[{alias:null,args:[{kind:"Variable",name:"input",variableName:"input"}],concreteType:"SetDenseModeResponsePayload",kind:"LinkedField",name:"set_dense_mode",plural:!1,selections:[{alias:null,args:null,concreteType:"Viewer",kind:"LinkedField",name:"viewer",plural:!1,selections:[{alias:null,args:null,kind:"ScalarField",name:"dense_mode_setting",storageKey:null}],storageKey:null}],storageKey:null}];return{fragment:{argumentDefinitions:a,kind:"Fragment",metadata:null,name:"CometSetDenseModeMutation",selections:c,type:"Mutation",abstractKey:null},kind:"Request",operation:{argumentDefinitions:a,kind:"Operation",name:"CometSetDenseModeMutation",selections:

                                                                                                                                                                                                                                Chrome Cache Entry: 797

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (574)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3448
                                                                                                                                                                                                                                Entropy (8bit):5.484698692620344
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:o4Mjf+vi2hHGMmBUJFXtDaD6U81+K/tmbwTnw:0jf4fJLMhkdlah
                                                                                                                                                                                                                                MD5:C01A82AB927B56E6B5FA01F6CB78D8F7
                                                                                                                                                                                                                                SHA1:7C612A2A522DDD882C1DE037C38CFD0D05F6272D
                                                                                                                                                                                                                                SHA-256:11DB1E8D29DE3DA2678D53580C87CF5B9874BF842B7919861DE31FB1ECCA18E5
                                                                                                                                                                                                                                SHA-512:BE4366035AC2A2764A4557D4011EEBB5A339FA7C2214322F0293D516ACAD2E12CA4E9B6752B0CCE7D1581A17362835AA811EE7D8261D38204383736E1C9C49BB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var lsa=function(){var a=_.Pd();return _.Hi(a,1)};var qq=function(a){this.Ga=_.t(a,0,qq.messageId)};_.B(qq,_.v);qq.prototype.Ja=function(){return _.gi(this,1)};qq.prototype.Wa=function(a){return _.Pi(this,1,a)};qq.messageId="f.bo";var rq=function(){_.Lk.call(this)};_.B(rq,_.Lk);rq.prototype.Tc=function(){this.yO=!1;msa(this);_.Lk.prototype.Tc.call(this)};rq.prototype.aa=function(){nsa(this);if(this.Ez)return osa(this),!1;if(!this.EQ)return sq(this),!0;this.dispatchEvent("p");if(!this.aK)return sq(this),!0;this.NH?(this.dispatchEvent("r"),sq(this)):osa(this);return!1};.var psa=function(a){var b=new _.En(a.I_);null!=a.kL&&b.aa("authuser",a.kL);return b},osa=function(a){a.Ez=!0;var b=psa(a),c="rt=r&f_uid="+_.Rg(a.aK);_.jl(b,(0,_.sf)(a.ea,a),"POST",c)};.rq.prototype.ea=function(a){a=a.target;nsa(this);if(_.ml(a)){this.JF=0;if(this.NH)this.Ez=!1,this.dispatchEvent("

                                                                                                                                                                                                                                Chrome Cache Entry: 798

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):416
                                                                                                                                                                                                                                Entropy (8bit):4.4998346788589245
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slmOVIhSXX5xkgm2OCOuLQcTVgXF78Q46yAajyBxQkm3nKYKM1xE5LQI06:t4IjEXX1OC/QcuXFYFjyrQw15L2n6
                                                                                                                                                                                                                                MD5:DEDDD7D24561E4F2792208764242D5FA
                                                                                                                                                                                                                                SHA1:DA1A06B033CE9F27DD891B49E71FF3269A9F148C
                                                                                                                                                                                                                                SHA-256:73C8A18F388DF73D60C4AF2CF0700F889AD24D1557F79C63E37E9C9EAFC9C63F
                                                                                                                                                                                                                                SHA-512:8A738BB011625C122919C4D8216E285A51CDBA0EAEC6EBF1D16CE367312CCB13C8FD61BE1FACE96FE9746DF2F106BB788182F31C2222F7840A7EEC5A9731A94C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-off/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M16.5 12c0-1.77-1.02-3.29-2.5-4.03v2.21l2.45 2.45c.03-.2.05-.41.05-.63zm2.5 0c0 .94-.2 1.82-.54 2.64l1.51 1.51C20.63 14.91 21 13.5 21 12c0-4.28-2.99-7.86-7-8.77v2.06c2.89.86 5 3.54 5 6.71zM4.27 3L3 4.27 7.73 9H3v6h4l5 5v-6.73l4.25 4.25c-.67.52-1.42.93-2.25 1.18v2.06c1.38-.31 2.63-.95 3.69-1.81L19.73 21 21 19.73l-9-9L4.27 3zM12 4L9.91 6.09 12 8.18V4z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 799

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (467)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1883
                                                                                                                                                                                                                                Entropy (8bit):5.270984374425825
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:o7eM8KL3AiFxglr7iO7S6fg35rCyRWsRhdrw:opL3FxeT7SMJARhBw
                                                                                                                                                                                                                                MD5:434730EECF5430D42D426FFF04E3751F
                                                                                                                                                                                                                                SHA1:E6DC1BBDFCCB76D1F45789C0B55E4F9E5725B677
                                                                                                                                                                                                                                SHA-256:1BFAD0A3BD2AE9BE050D4A66CE800B030E5E33B6048D14FBECF0501A5728E2E9
                                                                                                                                                                                                                                SHA-512:F68561DF1AF16BE78F48EFA58D836C33246FF8C8ABDE323C9F2217797E027DC99A699ED3856252A0ACEBC601177B78C264F400B56C52B48B500B07BDE76F964E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.gY=function(a){_.I.call(this,a.Ha);this.window=a.Ea.window.get();this.Fc=a.Ea.Fc};_.B(_.gY,_.I);_.gY.Oa=_.I.Oa;_.gY.Ba=function(){return{Ea:{window:_.Oq,Fc:_.uC}}};_.gY.prototype.Cn=function(){};_.gY.prototype.addEncryptionRecoveryMethod=function(){};_.hY=function(a){return(null==a?void 0:a.Yp)||function(){}};_.iY=function(a){return(null==a?void 0:a.rca)||function(){}};_.jY=function(a){return(null==a?void 0:a.Zp)||function(){}};._.izb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.kY=function(a){setTimeout(function(){throw a;},0)};_.gY.prototype.fJ=function(){return!0};_.Lq(_.El,_.gY);._.l();._.k("ziXSP");.var IY=function(a){_.gY.call(this,a.Ha)};_.B(IY,_.gY);IY.Oa=_.gY.Oa;IY.Ba=_.gY.Ba;IY.prototype.Cn=function(a,b,c){var d;i

                                                                                                                                                                                                                                Chrome Cache Entry: 800

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):48
                                                                                                                                                                                                                                Entropy (8bit):4.157806386887449
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:ZjhnZNDrPKVXdl:ZjNjKVXdl
                                                                                                                                                                                                                                MD5:0D9FE9D3AA33DA6C96F6BF9AF269F8B5
                                                                                                                                                                                                                                SHA1:A089B5586CD5E479A0FD7D73591C7EC0C5A41235
                                                                                                                                                                                                                                SHA-256:1C9E270C0A66096127A7F58A326D4728465B433D744B3066F3F28CD5E87C9576
                                                                                                                                                                                                                                SHA-512:3A15B10B23D0259F2738B01517E734C41122D68EFA555BE2CC1E162028FB4C7E88617D783BA571D82554B9CE3DDAAAD046A4BEBAFA1A87D79CEBD5A7EDD17571
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwnAFtBk7-_xrBIFDQqzETASBQ0o8SlJ?alt=proto
                                                                                                                                                                                                                                Preview:CiIKEw0KsxEwGgQICRgBGgQIVhgCIAEKCw0o8SlJGgQISxgC

                                                                                                                                                                                                                                Chrome Cache Entry: 801

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):30376
                                                                                                                                                                                                                                Entropy (8bit):7.993469477869715
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:768:nyLS3UUfqRbeB4N+ENouruK/PNh+ibhT8aRoA2nn:nyLS3UUfJB4N+3EuhqTbRmnn
                                                                                                                                                                                                                                MD5:70ACAF625CC9A8D02C53ABBDC3506328
                                                                                                                                                                                                                                SHA1:9D2B25082EE5441631A9D032BFB1409D1A6C5957
                                                                                                                                                                                                                                SHA-256:EB9EBBAC968F4C9B04931780A19A782ED7838B3649C51279FD7A92E2E303CD8F
                                                                                                                                                                                                                                SHA-512:2F5B1D5F8BACA5A7100D9E017E2CA6043D7D1A77A63BE68E63FB92EEFBB1709EC4585BEA0AF8AAA5C1304F8ECBCF60A5C5987C0638170D257887BC13711E908B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/SnTIVWYLnUg/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDYrS9TG9sYy4kpbjHeqHLjVfJu6A
                                                                                                                                                                                                                                Preview:RIFF.v..WEBPVP8 .v.......*....>Q".F#..'..,H...emW..7....5....L.f.........Z.Y.S........Z..I........w.*}Ly.~.uH..y.M.!.S...g./.}....\.......^...Ee...........'D.}.....7?,.m.G...~.\.~cr....o.J.........`...w..........]...7.O...~.?.",".U..5L.4....|..Z....Z.{.K.o....n7.l..X.t...........B#0....>+C....-..O....d...|...l.[*.~...G.."uPq..x..id..<.E.......z...tX0Ln6,G...{.mD9/..TM.]..,.).>.%.....T.p.9.(O2.A.....4....`p.+..,+.s.#........#%..Z...J....1~..+I...[I...7...d...n..D..|.s.....7D.n..i.....(....'..E:./..@.PJ.~......m3;..p...h.r....K......>A'....5.9O2..}:....'X.rk..'.W.7.......'{L9Z8L<.|I..eO........".C.r....Y.=R.p...#X.?.5.......1%.A<y.5<sB..X.m...o-*.q..*5.{.r.w....6..T.9$...rT.......8..6.V.".}...^J.O.^...?.....T..S.e..#*.0..V.%........".B.. ......."..+Z...M.....V7.)...Q`.H.\.._O.m..l.B.6........c....pY$.....6'...[.B.V..g.gO|..hy.A.O...!fzE..n.6D........P.;..@/.o.|=Y/.{|..y..7...........-.V.R......U...H.'.z.{"Rl;t.%FO.x.....$2...{8...i,.8.+....

                                                                                                                                                                                                                                Chrome Cache Entry: 802

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (5311), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):5311
                                                                                                                                                                                                                                Entropy (8bit):4.950469424497734
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:B2cQbeDaksUebwlobsiJtKDUCbO/7p3uyFu7BtumruJbubbugWHxdXW:XOkAxMHwC/
                                                                                                                                                                                                                                MD5:81B422570A4D648C0517811DFEB3273D
                                                                                                                                                                                                                                SHA1:C150029BF8CEBFC30E3698AE2631A6796A77ECF1
                                                                                                                                                                                                                                SHA-256:3C8B38D9B8A3301C106230E05BEEEDBCD28B12681F22FD9B09AF9E52DC08635D
                                                                                                                                                                                                                                SHA-512:1D4966A88D7CF6BE31B8F53547A12DB92CABB4C05176ABE995C75C8889765EC68B7210C3BE75F60954CEB2938412FBDEB94D4D25DDC927F3A89ECA76A84A9EBC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/cssbin/www-main-desktop-watch-page-skeleton.css
                                                                                                                                                                                                                                Preview:#watch-page-skeleton{position:relative;z-index:1;margin:0 auto}#watch-page-skeleton,#watch-page-skeleton #info-container,#watch-page-skeleton #related{-webkit-box-sizing:border-box;box-sizing:border-box}.watch-skeleton .text-shell{height:20px;border-radius:8px}.watch-skeleton .skeleton-bg-color{background-color:hsl(0,0%,89%)}.watch-skeleton .skeleton-light-border-bottom{border-bottom:1px solid hsl(0,0%,93.3%)}html[dark] .watch-skeleton .skeleton-bg-color{background-color:hsl(0,0%,16%)}html[dark] .watch-skeleton .skeleton-light-border-bottom{border-bottom:1px solid hsla(0,100%,100%,.08)}.watch-skeleton .flex-1{-webkit-box-flex:1;-webkit-flex:1;flex:1;-webkit-flex-basis:0.000000001px;flex-basis:0.000000001px}.watch-skeleton #primary-info{height:64px;padding:20px 0 8px 0}.watch-skeleton #primary-info #title{width:400px;margin-bottom:12px}.watch-skeleton #primary-info #info{display:-webkit-box;display:-webkit-flex;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-web

                                                                                                                                                                                                                                Chrome Cache Entry: 803

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1774
                                                                                                                                                                                                                                Entropy (8bit):7.148954830584463
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:grkpiWGNqWYsBqXpfFvIpxaVMruiEUk9mH8Sr7/:b5EBqXpfFvIpEMC5Uk9qZH/
                                                                                                                                                                                                                                MD5:7C8633B0FCE14D4E6AFA13ABCCFCD786
                                                                                                                                                                                                                                SHA1:1907DAC7F1F62FFAE7786F15C0749DA463F451F6
                                                                                                                                                                                                                                SHA-256:73F12E5E18356A71B9C220112664ED7E8C2EE5B86A3DDB50F56428F5B27ABF92
                                                                                                                                                                                                                                SHA-512:5E0577745556CD917A467FFE4FCA85A07891C4077085A343214B34D3F858EDE2C8E1C339760CB4D4BA2D3CBDFC2527074B9716617F8A8EFA45B288F72AB63490
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/399636783_250646354661340_4044116219390951313_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=M1c165CpJtsAX_yFdk2&_nc_ht=scontent-lga3-2.xx&oh=00_AfCbYlIohgRJRJbPVSQJukgfKRHfBBEFlgvfX5Q4nzLzyA&oe=65DA8CB6
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e701000091020000d60200002803000006040000e104000018050000560500009a050000ee060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................W...yO>&..-.?.y.K.I.....WA...4...41J..`.>.~.p..mX.6.)6..qr....e2.o..."..........................!"4.............`..j..pVL..%.A/.. .Jk..UO.........1...h.\...BNc..n..B.1Z.{.v.8.HT....C...R..4b-..sS...r....0P..`...[.$ i.d~.a}.G...^2.....?............................1A.!........?.s.H....D.v1l.M.".5.x.8EO.............................1AQa........?.Y...V.4.uZu..2./..=._...1......................!..2AQa"1q..R..#4Bst.............?.,x.i......*.[I..I./p'>sA....J...I..i.6K.#.V.-.Av.+/%.\..e...OG(L<4.h.M..5.......}. ...G>......^...'..+.....8.7N..52.By.9 .A...$..O...7.6.S.q&.s&ew|.fSF.......S:!..G......%.....

                                                                                                                                                                                                                                Chrome Cache Entry: 804

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):579
                                                                                                                                                                                                                                Entropy (8bit):4.50640845727472
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRprcQLVhjrAY5uiK8KnnY8/4U0wRJIAoZ6iiMUV0TDoc:t4jU/vycQrjrAY3/Kt/4U0OIFoUzTD3
                                                                                                                                                                                                                                MD5:C0CCA7B6C1295E79FE9BBE405122AC53
                                                                                                                                                                                                                                SHA1:69C36F5A0F8E20DC556123F6AF6E0B5AE7DBC18B
                                                                                                                                                                                                                                SHA-256:6151B1FC5DE0D15BEF2AEAC1B8743AD6A54D9BD44FF5C507321450528D212749
                                                                                                                                                                                                                                SHA-512:82C80A388F7900F73F38DEA8C0AA92D4EFF9D96D99C4BB8821689E041582D8E885EDE4618CD24C802C4ABE599F6E187801D5AB04D4751D062BAEED06551B0185
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/fire/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M19 3.87v9.77C19 17.7 15.86 21 12 21s-7-3.3-7-7.37v-.13c0-1.06.22-2.13.62-3.09.5-1.19 1.29-2.21 2.27-2.97.85-.66 1.83-1.14 2.87-1.65.39-.19.77-.38 1.15-.58.36-.19.72-.38 1.08-.56v3.22l1.55-1.04L19 3.87M20 2l-6 4V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29-.7 3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2zM9.45 12.89 14 10v5.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.23 1.45-2.81z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 805

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):208
                                                                                                                                                                                                                                Entropy (8bit):5.110480219410639
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4PaVRLUUkJUaBSY:t47N9U/vmRPaVRwUqUwz
                                                                                                                                                                                                                                MD5:F5C29B3D10DCCAB880085999FDBB6302
                                                                                                                                                                                                                                SHA1:779A18F5C8FCBA076D1F341DE5F0CD67AFDC7CCA
                                                                                                                                                                                                                                SHA-256:177CADE5695A4267C5F90F5BA834636B75C32295DF99AC58B1EA1B97068E8058
                                                                                                                                                                                                                                SHA-512:0428E50266C32E9825071A940FFC85DAA454106931B7E3873C3187D95FCFF97D64088D50344B4B7CAD6DDF1FA4210C1A3BEC39F0F524B73AE31FDB065E5E3726
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/open_new/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M21 21H3V3h9v1H4v16h16v-8h1v9zM15 3v1h4.32l-8.03 8.03.71.71 8-8V9h1V3h-6z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 806

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):749
                                                                                                                                                                                                                                Entropy (8bit):4.70368920713592
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4nolW84qhebl8cP5UbKEBnStLJdJad+DB3xELFkXUIx+RWuSrtUjAC9ZiCWInLE:t4olS+2x5UbKrTJ9DA0YWrrmWCFzfIvB
                                                                                                                                                                                                                                MD5:AA920B32443219E3EDFA32DEF5EBD457
                                                                                                                                                                                                                                SHA1:8A4B47D0A2CA261803AA5C1A9DDE7BA3FE15B298
                                                                                                                                                                                                                                SHA-256:E5773339E56DD15D8DAAB94CE6ED5D444D1EF0B61355E20854234605BB2E755B
                                                                                                                                                                                                                                SHA-512:C45BDB233447E1F4D3B4B5174A328E3D8987C9B5E2E12733E5027173B0302919680901C311094714CFC32AC2F2C749DC9EB95FFCAA8F5DA1E5EBEF3FB7225E37
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="36" viewBox="0 0 36 36" width="36"><path d="M34.32 18.39c0-1.17-.11-2.3-.29-3.39H18v6.48h9.4c-.38 2.19-1.59 4.05-3.42 5.31v4.1h5.28c3.2-2.97 5.06-7.33 5.06-12.5z" fill="#4285F4"/><path d="M18 35c4.59 0 8.44-1.52 11.25-4.12l-5.28-4.1c-1.57 1.08-3.59 1.71-5.97 1.71-4.51 0-8.33-3.02-9.73-7.11H2.82v4.23C5.62 31.18 11.36 35 18 35z" fill="#34A853"/><path d="M8.27 21.39c-.36-1.07-.57-2.21-.57-3.39s.21-2.32.58-3.39v-4.23H2.82C1.67 12.67 1 15.25 1 18s.67 5.33 1.82 7.63l5.45-4.24z" fill="#FBBC05"/><path d="M18 7.5c2.56 0 4.86.88 6.67 2.61l.01.02 4.7-4.7C26.43 2.68 22.59 1 18 1 11.36 1 5.62 4.82 2.82 10.37l5.45 4.23c1.4-4.08 5.22-7.1 9.73-7.1z" fill="#EA4335"/><path d="M1 1h34v34H1z" fill="none"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 807

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (49034)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):592309
                                                                                                                                                                                                                                Entropy (8bit):5.292467385380899
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:vofCOBsBIGEdIJ0yzTBC+UOM7LX84WxlMJvxHTIXzCZl414r9L2ucD+XB7b7k9lV:gsBAsVc+UjLC28Xzo41G9aucD+XtmlV
                                                                                                                                                                                                                                MD5:A29E4C2A66F2DC597D68732186317316
                                                                                                                                                                                                                                SHA1:83590796671CECF57F9B38095BB12CB91A137C52
                                                                                                                                                                                                                                SHA-256:0E866B90C47D7C127275C966527EA39F1826C98A9911897E7751DDF7A91F6A2E
                                                                                                                                                                                                                                SHA-512:10F9146C716FE50F9F3DF4E742F3D5C81EA605F32A6AF719D405514FC7B1E097E5FA228E2134BC8854CEFE8042380CD1E09F57AB4A5A12980FCDFC6FB62550F4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://static.xx.fbcdn.net/rsrc.php/v3/yO/l/0,cross/aIDgjGCzNgo.css?_nc_x=Ij3Wp8lg5Kz"
                                                                                                                                                                                                                                Preview:form{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textarea{max-width:100%}select{border:1px solid #ccd0d5;padding:2px}input,select,textarea{background-color:#fff;color:#1c1e21}.inputtext,.inputpassword{padding-bottom:4px}.inputtext:invalid,.inputpassword:invalid{box-shadow:none}.inputradio{margin:0 5px 0 0;padding:0;vertical-align:middle}.inputcheckbox{border:0;vertical-align:middle}.inputbutton,.inputsubmit{background-color:#4267b2;border-color:#DADDE1 #0e1f5b #0e1f5b #d9dfea;border-style:solid;border-width:1px;color:#fff;padding:2px 15px 3px 15px;text-align:center}.inputaux{background:#ebedf0;border-color:#EBEDF0 #666 #666 #e7e7e7;color:#000}.inputsearch{background:#FFFFFF url(/rsrc.php/v3/yL/r/unHwF9CkMyM.png) no-repeat left 4px;padding-left:17px}.html{touch-action:manipulation}body{back

                                                                                                                                                                                                                                Chrome Cache Entry: 808

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):127
                                                                                                                                                                                                                                Entropy (8bit):4.930844660349543
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHL1FId/cIS0:tI9mc4slhohC/vmI4spn
                                                                                                                                                                                                                                MD5:2C360266A09D79360E247507EF3D2D60
                                                                                                                                                                                                                                SHA1:AC14D7F9042F470FEE0D48B3D9E6EDBC505285BC
                                                                                                                                                                                                                                SHA-256:A1C7A119AC9C663E0CD98E8BA6992F8B876F19D92252EB4FDFB1AF0594B70061
                                                                                                                                                                                                                                SHA-512:FEFE8721063067B784D713E43FF5C05928AFCC19ED2BB5B07536F39523B7F3B2C61E8E98EC68F0E8BF8E406262D00F5A77A0A5A7DA07A2D49EF479FF04D2B1CF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/pause/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M9 19H7V5h2Zm8-14h-2v14h2Z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 809

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):279627
                                                                                                                                                                                                                                Entropy (8bit):5.151957894348034
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:c2hPacZGzlBAgyxOmwn135UAcRCHgK0icNaQeUTUdDYubFryHgjKbntICUR:N83tMSC4
                                                                                                                                                                                                                                MD5:67415238A0ED99286F8261E4A6CDFBE5
                                                                                                                                                                                                                                SHA1:86EBB0BBD60D8D6BBDC80AA60BC809F17FA9F6D3
                                                                                                                                                                                                                                SHA-256:7C3190461704D64CB2FB3BBE447902518DCC8A93536E10B7D3475B8ECB836152
                                                                                                                                                                                                                                SHA-512:01B036685AFA19E0EE5299A6076C76384A18493345E8EF887CBE2B07B3C79B44F1AA3615918807C6BAA876263A5201D4A36195ACCFFA555F6B3F42503EBE6C7A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/642e1qh28prue1yv3o1kqf3z9
                                                                                                                                                                                                                                Preview:li-icon[type="linkedin-bug"] .background{fill:#000000}li-icon[type="linkedin-bug"][color="brand"] .background{fill:#0077B5}li-icon[type="linkedin-bug"][color="inverse"] .background{fill:#ffffff}li-icon[type="linkedin-bug"][color="premium"] .background{fill:#AF9B62}.artdeco-premium-bug-variant li-icon[type="linkedin-bug"][color="premium"] .background{fill:#EFB920}li-icon[type="linkedin-bug"] .bug-text-color{display:none}li-icon[type="linkedin-bug"][color] .bug-text-color{display:block}li-icon[type="linkedin-bug"][color="inverse"] .bug-text-color{display:none}li-icon[type="linkedin-bug"][size="14dp"]{width:14px;height:14px}li-icon[type="linkedin-bug"][size="21dp"]{width:21px;height:21px}li-icon[type="linkedin-bug"][size="28dp"]{width:28px;height:28px}li-icon[type="linkedin-bug"][size="34dp"]{width:34px;height:34px}li-icon[type="linkedin-bug"][size="40dp"]{width:40px;height:40px}li-icon[type="linkedin-bug"][size="48dp"]{width:48px;height:48px}li-icon[type="linkedin-bug"] svg{width:100%;he

                                                                                                                                                                                                                                Chrome Cache Entry: 810

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):441
                                                                                                                                                                                                                                Entropy (8bit):4.728282635502173
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRR9jRxmHRLkCsL9IxflMwhT2fLrYVMdubTci:t4jU/vJHNklhIwwhqgVMEci
                                                                                                                                                                                                                                MD5:B15A744B5ED7D5D8A779E411F513E24C
                                                                                                                                                                                                                                SHA1:F156A8D2F03E4FFB072FF7D2241DDCA911664B0E
                                                                                                                                                                                                                                SHA-256:43B5B8ECC8D128FDD2DF4366CBE6FDD8ED0067DC117438290F59F5A0FFAF715D
                                                                                                                                                                                                                                SHA-512:3381EC00EEE98892B08E5C47929FFC27129A92ACF486CC33DB7E7DE1128ACBADDCCAA75115A40BC6A91B97CA39FCB42E0661341BF433299720C80DBB3EDBFF20
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/bell/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 20h4c0 1.1-.9 2-2 2s-2-.9-2-2zm10-2.65V19H4v-1.65l2-1.88v-5.15C6 7.4 7.56 5.1 10 4.34v-.38c0-1.42 1.49-2.5 2.99-1.76.65.32 1.01 1.03 1.01 1.76v.39c2.44.75 4 3.06 4 5.98v5.15l2 1.87zm-1 .42-2-1.88v-5.47c0-2.47-1.19-4.36-3.13-5.1-1.26-.53-2.64-.5-3.84.03C8.15 6.11 7 7.99 7 10.42v5.47l-2 1.88V18h14v-.23z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 811

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 10 x 10, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):79
                                                                                                                                                                                                                                Entropy (8bit):4.71696959175789
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:yionv//thPlH1tnt/tAhHGZscm1olkqCwbp:6v/lhP6hHDcZCYp
                                                                                                                                                                                                                                MD5:8DC258A49B60FAE051E9A7CE11AD05CF
                                                                                                                                                                                                                                SHA1:DAFEF280663F4205FC7F0E47799E9945E6A68D6D
                                                                                                                                                                                                                                SHA-256:C8CAED93847AFFC154CB3D424E34FC146E7340BB29ABEBD5EBA7063E3DCA0604
                                                                                                                                                                                                                                SHA-512:5F11ED60D79A80EF7CCEFFA907CD55F31D8DB19BD2A7F4C2650C62A355C5071C5FB61DA1EB0A2071CE22ECDC35C0D12F51E4D13AAC3B0FDB95ED4629815B5AFB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR..............PX.....IDAT.Wc...0a.!..)....A,....Zl....IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 812

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):14925
                                                                                                                                                                                                                                Entropy (8bit):7.948866645874151
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:Lo6YsMV3fKGmBTo+sEkVumOtlE6VyYuwOp2i06YRFGUK:Lo6YsMV3fKvBTo+pAuxtlE6VyMO096G+
                                                                                                                                                                                                                                MD5:768F644E98C496FFAF3EE4AE81BC1409
                                                                                                                                                                                                                                SHA1:ED2203129E092F5124F4B939DB745817A3D8DC9E
                                                                                                                                                                                                                                SHA-256:A9E13A75C27F14A4B65AC54A1A74A145BEB0CDEE13125145211AD9880702A91B
                                                                                                                                                                                                                                SHA-512:B2FA8B86762EB4E101FA4BCC75E07F969E69A411910925015EBDF2CEB576BD26C84DE5FCB847FEB05F933BDF8A8F67B0CFDDED609BDB5E1A3672FC5DF0AFD71B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/415181008_299954916378344_1757927736941067255_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=GfA8KWVuMHsAX8iXTmz&_nc_ht=scontent-lga3-2.xx&oh=00_AfBzzOb4kl-WFTW5v4Tz92WeLBw28-hMfEPOKU-r-bsH-w&oe=65DB22CD
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000ed050000110d0000500e00007a0f0000bc150000842100009b22000038240000b62500004d3a0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."................................................................................bI....;..(.:bN..S$..$..Z...o+.1f'i....Y..%'....... .f3}-.X..t....3=$L.]=1....)..t..D.].=.#..Y."....=Ux..Bg...,;.V&I"d.k7.+....o>..!#g&..".8.2..yO....=.-,................r.\.s:P.x.6.l~....F.....a.wRn.S...6.f.U..6...L%v.\..5...]..,..ve.....|.4.._.....!.-...H.'...W.*.Y=e.6...|....M5.QF.L.v...............:.....6.f.~ziMn{....O....vx..|.E....P.....Jt...\.....6...P..>..'..u.:..U..e....'[...^.*^n...V.S.^C.`/Q....Ok....0u+.v...Z.:V&;.|.6(.=~.)..zs.g.....}..\Z.#._T.6<...L.DYD...en.:.|..]}%.+.n.p...S......p...O..{..=O.oW..L..K..&y"f.i..]...[#..B..........PG..Z.....'.......w...VP

                                                                                                                                                                                                                                Chrome Cache Entry: 813

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (715)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):50702
                                                                                                                                                                                                                                Entropy (8bit):5.373070303650078
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:Ifd/sRuiALPAavkj70bI5D4nDltOC2B7F:IfdURZGvkjob44J8F
                                                                                                                                                                                                                                MD5:44CA3D8FD5FF91ED90D1A2AB099EF91E
                                                                                                                                                                                                                                SHA1:79B76340CA0781FD98AA5B8FDCA9496665810195
                                                                                                                                                                                                                                SHA-256:C12E3AC9660AE5DE2D775A8C52E22610FFF7A651FA069CFA8F64675A7B0A6415
                                                                                                                                                                                                                                SHA-512:A5CE9D846FB4C43A078D364974B22C18A504CDBF2DA3D36C689D450A5DC7D0BE156A29E11DF301FF7E187B831E14A6E5B037AAD22F00C03280EE1AD1E829DAC8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js
                                                                                                                                                                                                                                Preview:/*.. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License... Copyright 2016 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,.

                                                                                                                                                                                                                                Chrome Cache Entry: 814

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (16083)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):740380
                                                                                                                                                                                                                                Entropy (8bit):5.729920688068108
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:ZA18+tja0OU+uiAlgU/u0rLDmi6Dcga7ciEskOxCoiuNRF:ZTGjvOZArrdciBkpSF
                                                                                                                                                                                                                                MD5:F98FC311A243467E1323D5CF6E73D4E9
                                                                                                                                                                                                                                SHA1:C917CCF1F88AA7D74C8CDD4B3A4B5C5270FFA520
                                                                                                                                                                                                                                SHA-256:86B01C31FAF78C4C275A4CD608DD112C461B7B3553D50129EFED438000D392A8
                                                                                                                                                                                                                                SHA-512:149022F0DA5D7491E9AE198D3DB033865AE1D0E399A0F0BD98BA3EDE34659461D0042B962D10B4DFD45DD29850C6FE734D6027DE00BE4493B8CAC31B6B401516
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                                                                                Preview:"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

                                                                                                                                                                                                                                Chrome Cache Entry: 815

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):42610
                                                                                                                                                                                                                                Entropy (8bit):7.961589859319249
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:z/YXAkZ+RvShVPexSkCnF51+i8Kc209TJvob0J/mBkA5KFYhz+et:zgt+Kosko/YJJ1JOlQYhtt
                                                                                                                                                                                                                                MD5:D7ABE4C5197CAC40A4BFE5C9910595CB
                                                                                                                                                                                                                                SHA1:7D60055C5F57C570FF1FCA995F16EEBAD77EE0CE
                                                                                                                                                                                                                                SHA-256:542B2A954C80DA314E377B10BB1B8E23068BA6502DA694879211793068443A47
                                                                                                                                                                                                                                SHA-512:2BEBCFC7A551E59869F087C509CA9157ADD3A085D1EBE74654460837C5D72CE84B2DA0276D2A961C69D6CF9620575353156125F03E6FBD274ED7C50FAE477515
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426294730_2077624149278674_879459938867030875_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=EDsAD8iInKwAX8muqA8&_nc_ht=scontent-lga3-2.xx&oh=00_AfCQcTr7dDDAaMEm05OI83Eb4w4OHlJ-Y4x-Dz7inSCOhQ&oe=65DA8FCC
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a710100005a1a0000a9360000603a0000503d0000bd4d0000b4690000e76f0000457400004e78000072a60000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."............................................................................................................................................................HE!..R.HE!..R.HE!..R.HE!..R.HE!..R.HE!..R.HE!..R.HE!..R.HE! ............................................................................................................................................................*.....<%...^.<%...^.<%...^.<%...^.<%...^.<%...^.<%...^.<%...^.<%...^.<%...^.<&..c..^../.{...wC...............,....y7vo...s....=0.N.....g.~{].5........7.).n.(.....c.r>..Y.9}..]..z~...%.O.z...k2.........kd.........u..L......W.......8.e..*r=..5R..O.....<..8....I..\C..9....\Y...'Qn....k.ox..9..j..`....C..o;.5G

                                                                                                                                                                                                                                Chrome Cache Entry: 816

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                Entropy (8bit):4.734767648393338
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRvxXUjvuoVFMScupjUJEFNJFyOXV/:tI9mc4slhohC/vmVR5XUjvuoVFbpjUJc
                                                                                                                                                                                                                                MD5:117AB951A6D6204AC74B0A8A2DEBB839
                                                                                                                                                                                                                                SHA1:0EBD5BAB716E8A101783C60471EA52745CB8459F
                                                                                                                                                                                                                                SHA-256:988C2499EC07A895EA5B31AB308610995B4F4480142571A47FCD0FFA1A0EFA41
                                                                                                                                                                                                                                SHA-512:2CC4D015CE64DF7D8390ABF7BD7339B4DFA090E89C37135692C8652E59A46C4BBCD7A451C8B6E45F070A4C3F46935EA51B78F67DAC181B0C38CA1CBC62F000DD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/arrow_up/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="20.21,11.79 12,3.59 3.79,11.79 5.21,13.21 11,7.41 11,20 13,20 13,7.41 18.79,13.21"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 817

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):196
                                                                                                                                                                                                                                Entropy (8bit):5.091943569663142
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHOoZKbVDCjG1UfJQNK:tI9mc4slhLJ9hC/vmI4pZKeG/i
                                                                                                                                                                                                                                MD5:93255FE74E40903D5D6D53BDCB39798D
                                                                                                                                                                                                                                SHA1:3782892EA18A26A0117F1D206964B0CBA9E9E445
                                                                                                                                                                                                                                SHA-256:C7ED29A9FD41A91422C00A05C48EEE65C48F5CFF70D57D1424F00D1D70A3B85C
                                                                                                                                                                                                                                SHA-512:BC200854BF7F3570874CD2122B25DBC5DA1816DCF4CD2E2FB2549DB90EB9B279CAFF7F10C854F78D64B4742E1CCB0A3FF0D78D0833E57EE7DF5A80C78B9F66A4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/subscriptions/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M20 7H4V6h16v1zm2 2v12H2V9h20zm-7 6-5-3v6l5-3zm2-12H7v1h10V3z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 818

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (826)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):8035
                                                                                                                                                                                                                                Entropy (8bit):5.326159900569122
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:scBpCBhS6OycT4w9uTEs/tQ7x09fih6axjOrFBh/ZQxKY8X2UBYRMwtRdB:/fEw9uQsamojEFBh/WxhB
                                                                                                                                                                                                                                MD5:FDA114F94E54E698B9F2916A3F0046F0
                                                                                                                                                                                                                                SHA1:5E14300C2D580CEB721201B14C19A858734EB2D7
                                                                                                                                                                                                                                SHA-256:0833BBD2F41E11AD56CAD5E1E52CCDAFB40F3ABB8D71CB3C8B777455DFFEA95A
                                                                                                                                                                                                                                SHA-512:008E7B7CD839C1B3BFBBFBEF6A5046BAE979FE95A5400CA45765EB74E94594505BB62C42A4F289B86D2B525919884B8B807A025C6C9E4FF43399829E201913E5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.qLa=_.y("wg1P6b",[_.Dx,_.Gl]);._.k("wg1P6b");.var m0a=function(a,b){b=b||_.Ma;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);0<g?c=f+1:(d=f,e=!g)}return e?c:-c-1},n0a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},o0a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return n0a(b,a)},p0a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.zg&&!(9<=Number(_.Gg))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a||a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?n0a(a,b):!c&&_.nh(e,b)?-1*o0a(a,b):!d&&_.nh(f,a)?o0a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Zg(a);c=d.createRange

                                                                                                                                                                                                                                Chrome Cache Entry: 819

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (45939)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):136364
                                                                                                                                                                                                                                Entropy (8bit):5.126072695543888
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:YQ5uEi/bA+TnJDpamoObnmodwbwnwmwowd6/yW8RNK+blic1rU6fJGnjkuC6hfMW:rblic1rU6fJGjQ6hkefClYT+Ksc
                                                                                                                                                                                                                                MD5:CEDCAFD723DC407D51EBF9659ED093E8
                                                                                                                                                                                                                                SHA1:E466B889B8C527ECE8B428A5AF84737A2FE39433
                                                                                                                                                                                                                                SHA-256:F2BABCBB7C5F1390299D492DF23A585EBACEE80939034749AFCE66D099B8C2CA
                                                                                                                                                                                                                                SHA-512:A8188512961D31A926C9889A605F634BC9D1D572F450C302CAF0299741F594F4411F9743B4C5E6A55D17C33E5B67FEC4E0942303656BC6A56CB2B5F81BE89C65
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iQbs4/y1/l/en_US/zx3qoVF3sUZ.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometImageFromIXValueRelayWrapper_sprite.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometImageFromIXValueRelayWrapper_sprite",selections:[{alias:null,args:null,kind:"ScalarField",name:"sprited",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_map_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"preloading_spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"w",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"h",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"p",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sz",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},{alias:null,args:null,kind:"ScalarField",na

                                                                                                                                                                                                                                Chrome Cache Entry: 820

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 2560x520, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):22017
                                                                                                                                                                                                                                Entropy (8bit):2.393402761741637
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:yDS5X1yo0XxDuLHeOWXG4OZ7DAJuLHenX3RZTdJATPbTPbTPbTPK:S6X1juERAdfATPbTPbTPbTPK
                                                                                                                                                                                                                                MD5:598EFD395C4596A5F0B48BFADF918A84
                                                                                                                                                                                                                                SHA1:C32EA8406DE7742007FDDF2B8C0035318F63772A
                                                                                                                                                                                                                                SHA-256:DC5B9CB12D4293961921B0966A5C5D1217DCEEEA689D8DD762B9F6DE3D4B8CE5
                                                                                                                                                                                                                                SHA-512:FAE9463290F026CA4419B81190483EB41B126CC8D9A38323D9D8E6DD28B03FA8DB2BD4AA80EDB62516E0B5A2F04C58D8FB8F4466477D9B9E9BE880D4056E22AA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/promos/growth/dc5b9cb12d4293961921b0966a5c5d1217dceeea689d8dd762b9f6de3d4b8ce5_2560x520.jpeg
                                                                                                                                                                                                                                Preview:......JFIF.....H.H.....LExif..MM.*.......i...........................................................8Photoshop 3.0.8BIM........8BIM.%..................B~..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................................................................C....................................................................C...................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

                                                                                                                                                                                                                                Chrome Cache Entry: 822

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):159
                                                                                                                                                                                                                                Entropy (8bit):4.915607757159961
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHC/TFicZHLpsTLXcA1:tI9mc4slhohC/vmI4CbFxIcK
                                                                                                                                                                                                                                MD5:D4FE0331328D6ADCB2D4B88D0996420C
                                                                                                                                                                                                                                SHA1:BF668E3964C3BCD702650BB20E28FD303296124F
                                                                                                                                                                                                                                SHA-256:616130E8A2BE44E0FDCFA1D3C7661172F2FED1471597820F8A3CAF01F4FBE2DF
                                                                                                                                                                                                                                SHA-512:16DA047FE96F9808AF68EF19E64736114FD3620127964A86973A86401375E128CA99F6C937D1123AE4FD10EEE5079B24BF6C721028582EDEE37176254EE5E3D9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_left/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.96 18.96 8 12l6.96-6.96.71.71L9.41 12l6.25 6.25-.7.71z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 823

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (467)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1883
                                                                                                                                                                                                                                Entropy (8bit):5.270984374425825
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:o7eM8KL3AiFxglr7iO7S6fg35rCyRWsRhdrw:opL3FxeT7SMJARhBw
                                                                                                                                                                                                                                MD5:434730EECF5430D42D426FFF04E3751F
                                                                                                                                                                                                                                SHA1:E6DC1BBDFCCB76D1F45789C0B55E4F9E5725B677
                                                                                                                                                                                                                                SHA-256:1BFAD0A3BD2AE9BE050D4A66CE800B030E5E33B6048D14FBECF0501A5728E2E9
                                                                                                                                                                                                                                SHA-512:F68561DF1AF16BE78F48EFA58D836C33246FF8C8ABDE323C9F2217797E027DC99A699ED3856252A0ACEBC601177B78C264F400B56C52B48B500B07BDE76F964E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=iAskyc,ziXSP"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("iAskyc");._.gY=function(a){_.I.call(this,a.Ha);this.window=a.Ea.window.get();this.Fc=a.Ea.Fc};_.B(_.gY,_.I);_.gY.Oa=_.I.Oa;_.gY.Ba=function(){return{Ea:{window:_.Oq,Fc:_.uC}}};_.gY.prototype.Cn=function(){};_.gY.prototype.addEncryptionRecoveryMethod=function(){};_.hY=function(a){return(null==a?void 0:a.Yp)||function(){}};_.iY=function(a){return(null==a?void 0:a.rca)||function(){}};_.jY=function(a){return(null==a?void 0:a.Zp)||function(){}};._.izb=function(a){return new Map(Array.from(a,function(b){var c=_.n(b);b=c.next().value;c=c.next().value;return[b,c.map(function(d){return{epoch:d.epoch,key:new Uint8Array(d.key)}})]}))};_.kY=function(a){setTimeout(function(){throw a;},0)};_.gY.prototype.fJ=function(){return!0};_.Lq(_.El,_.gY);._.l();._.k("ziXSP");.var IY=function(a){_.gY.call(this,a.Ha)};_.B(IY,_.gY);IY.Oa=_.gY.Oa;IY.Ba=_.gY.Ba;IY.prototype.Cn=function(a,b,c){var d;i

                                                                                                                                                                                                                                Chrome Cache Entry: 824

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 405x720, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):59060
                                                                                                                                                                                                                                Entropy (8bit):7.996465891591966
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:768:SEcHGBek0mXRRpps1gQJJw6n7C9g6ZbHMfflGrPbAOSOIThv0FvUUu2tBvQtg:SEcKfnXRRU1FFu9gQufluR4SFfwtg
                                                                                                                                                                                                                                MD5:D82F32A81089AA8BD2910A44F01963F7
                                                                                                                                                                                                                                SHA1:4FB9996E5A763A0708E67CB8F52E302D9BEE693F
                                                                                                                                                                                                                                SHA-256:8F2C66F266D9ACE1FFBD277ABBAE17B00B60A5B77B0E5A9EFBAF0B46F094EC3E
                                                                                                                                                                                                                                SHA-512:ADBFA87C33268F7D8AEE72FDAAE848283FD73E705701ACFE8F791749B48EB3DF4DCF1367E2986026D7C7A4236DE962F1DF34A3A0866288BBB822F7017DDFB833
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/fRdOeHM6mFc/oardefault.jpg?sqp=-oaymwEdCJUDENAFSFWQAgHyq4qpAwwIARUAAIhCcAHAAQY=&rs=AOn4CLDXeq_DLBgu3JH2LJhMdEXx65JHuQ
                                                                                                                                                                                                                                Preview:RIFF....WEBPVP8 .........*....>Q".E#.!%).....cl...s.{O.@.7....<....=d..v.....V.R.._Y...O.z.r...-....@}/..a.....}........_........{...G.O.G.G.?.......z....y...c.c......i.._.h...[.S./.o..#.....?t....~...u.........'.G./.?....y.........L.e...................S.............................~...7.o.."...........7....N_....k..............y...../......v?...._......~.....z.. ..#.^...G.\..>6X..3iJh;....C?...mCC...A. E..../..$s%<../,....T^a.....`.-..H.....Y.....38CL.V..3@..5..K...1..G...N ...Y...4..1.j...=.5..$%....;.6.:!-..I.^....<...R....KtS%...nc{........w..J.....G..X..?|.Y+.?..P.J...)[..N..g.LP2X......K.*y./....q.B.%....n7...nS@}.&7`.*..sZ$3.W.....2.'%..R.<:p.K.g.,...N..Ti..3....7....Y...U...LS..p..(jq./.X....t.'?nm.}!....v5...v...&..;..^..2}d...`.Tn..nM.f." ..7...J.MRDi.`..}.By:z.}T..'....Bm.& ..L?~-.\u..N...NWc*..{i+z.bgq....C..s@1-....(.c.')xKf....a..%.p..t.. ...o.h_.....?.u..+..r..t...q...........V...O...=.M.D..a.3ljF...~.h...sH\Z.Y.y.

                                                                                                                                                                                                                                Chrome Cache Entry: 825

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):364
                                                                                                                                                                                                                                Entropy (8bit):4.5307728192386865
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4wFs0BIiV2DTFVRrZjih9gCqzOfHLVlZ7YoPV3aXtJlIXtz3:t4noU/vmRwFs0BIXDJHNjihnbH7Z7YOn
                                                                                                                                                                                                                                MD5:9EDB56221B5B65134491A96453F9407C
                                                                                                                                                                                                                                SHA1:323001B08DF5DF6962781334D9BDDDBDCFC9E0AA
                                                                                                                                                                                                                                SHA-256:5E020ADF6151A4814846CB07EC91E9902C8860F1445F5F9321C5FDD81A06F102
                                                                                                                                                                                                                                SHA-512:373A6F0D45A1B955DF57858CCCAB05503FA31962BA47D5FDE6F5039D8E7E7FF72EF7B2FF4BA261E80C7DA630016BE142C4E319FE7CE66B0FCE9C317E77016053
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/location_point/v5/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c3.31 0 6 2.69 6 6 0 3.83-4.25 9.36-6 11.47C9.82 17.86 6 12.54 6 9c0-3.31 2.69-6 6-6m0-1C8.13 2 5 5.13 5 9c0 5.25 7 13 7 13s7-7.75 7-13c0-3.87-3.13-7-7-7zm0 5c1.1 0 2 .9 2 2s-.9 2-2 2-2-.9-2-2 .9-2 2-2m0-1c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 826

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:HTML document, ASCII text, with very long lines (682)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):4119
                                                                                                                                                                                                                                Entropy (8bit):5.363860210804462
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:GkBsIzf6Aj6TQTdkvEc2K7UrtNoyd+ypYokBnz8oLw:3BHzn+Wm97UToyd+ypYokDc
                                                                                                                                                                                                                                MD5:B60A1BABBA7EDBA6C5A9FC4836A079C6
                                                                                                                                                                                                                                SHA1:082278E6B6E8A2F53237EE992E77FE45F8764957
                                                                                                                                                                                                                                SHA-256:A925BAF5E1E6227CE778335AE876AD0B2C0A46AF791E2FE0BE7D9548015BBD82
                                                                                                                                                                                                                                SHA-512:975738EE48432A77B3423E4BE71EE3FAEF65CF03EFA95A786357438132ECE6942ACF1163DB3A1513515A8617807D5C21DA44CB510E32DCA941927F5C369388B9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
                                                                                                                                                                                                                                Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.uf(_.hna);._.k("sOXFj");.var Rq=function(a){_.I.call(this,a.Ha)};_.B(Rq,_.I);Rq.Oa=_.I.Oa;Rq.Ba=_.I.Ba;Rq.prototype.aa=function(a){return a()};_.Lq(_.gna,Rq);._.l();._.k("oGtAuc");._.Gsa=new _.qk(_.hna);._.l();._.k("q0xTif");.var Cta=function(a){var b=function(d){_.bm(d)&&(_.bm(d).uc=null,_.er(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},qr=function(a){_.np.call(this,a.Ha);this.Ra=this.dom=null;if(this.Zh()){var b=_.sk(this.Cf(),[_.Uk,_.Tk]);b=_.wh([b[_.Uk],b[_.Tk]]).then(function(c){this.Ra=c[0];this.dom=c[1]},null,this);_.Dq(this,b)}this.Ma=a.nh.U7};_.B(qr,_.np);qr.Ba=function(){return{nh:{U7:function(){return _.ff(this)}}}};qr.prototype.getContext=function(a){return this.Ma.getContext(a)};.qr.prototype.getData=function(a){return this.Ma.getData(a)};qr.protot

                                                                                                                                                                                                                                Chrome Cache Entry: 827

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (555)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2504712
                                                                                                                                                                                                                                Entropy (8bit):5.663845300759951
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24576:ZEM4kdsJepUkt5ACmgRwDOZoxuwGzGtTFiW6UoveH2M8:z4kO00gRwDOZoxuwJFihveWM8
                                                                                                                                                                                                                                MD5:E0ADEB81A95B5CE2D852B1DA7CEA4528
                                                                                                                                                                                                                                SHA1:B56E9345A734C0C35FBD05AB042686698544B3AF
                                                                                                                                                                                                                                SHA-256:88D25B8C03E76364C6C7BBDD74F9686429648EE83A9367EE8347F8ED9E5ACB11
                                                                                                                                                                                                                                SHA-512:B66A26F328D403BA196253E82F738DAE597E6CEF8727E5DF01520DE54C3D53FDF196F1F2B169F1912E386B2D86D5E3BF43AC66DAF8778475E0B60ACBF418E0EE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/player_ias.vflset/en_US/base.js
                                                                                                                                                                                                                                Preview:var _yt_player={};(function(g){var window=this;/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. (The MIT License).. Copyright (C) 2014 by Vitaly Puzrin.. Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONIN

                                                                                                                                                                                                                                Chrome Cache Entry: 828

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):101917
                                                                                                                                                                                                                                Entropy (8bit):7.987505010220878
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:wfTrApIT9mNxFgKoBwcq+AC+XQZaUySmvh/mohn0xHGIo23NHJEeaI:UT1T9gnCq+WxUZ0lV0xH4oiNI
                                                                                                                                                                                                                                MD5:D727B57A11EE381C89CA7929DD676C41
                                                                                                                                                                                                                                SHA1:777E690968288308028B1BCDEC1214D94EA55437
                                                                                                                                                                                                                                SHA-256:66D39E9D061552DD2D9D80289784E071C89F8B6A3F13B6E0B7F9B372642D0D28
                                                                                                                                                                                                                                SHA-512:CF93FE1843D35B8E30C4808815973D2D66A349694876F0D590CB0B1E96E7D24DF105ED4227A5BB174B076253A17D0E3E776E398D15A8A7D4B1BD9CF7E1002698
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426672878_7257912627622141_7422094123668939649_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=Bu74lr5rZWgAX_42aiu&_nc_ht=scontent-lga3-2.xx&oh=00_AfB0GcYkE30kyhr5IJejqwJ4K3U8uHJZ3tACBUoolErB_w&oe=65DAB87B
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a710100004c220000595a0000e1620000f0690000ff9d0000caf10000fef70000f5020100320c01001d8e0100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((...........".................................................................................33..p.U..".F........9.......HL.z.D..G".H....Kd.jc.....o...te.o..<.$.......!U-.\..\....-zY...P......i: .DQ<!...+Dx3...S.:k.K@.L..Rv.]G..v..,. p.1.FnrZC;;7A..CY.=.5$.-........E*..F.KU.n...Juq..+DK.h.QK.F".... Mf.....P...lC...g9#....I.-.._+....aA.M.C.......b.rA.I..3*yy.l>`.wFA0.-.0....M.....V...a.U.EW...f...../.....s].xrvj....L\3..#F..fv.I.z.f.@D4H.)..k....f.B..tQ}...Q.k >....7;NC..\^./.(......o.~..8.....`..jtq..........m.]..@..3%.zb........Y~a....tM5..k..*....?@v.m\.Yp....5..CY.6..P....R..e~u/DA.1.t.v....z]b....U...DO.......K(Z.f..3s..@.cG[..l.;.].6......=I......J....9ej..X.

                                                                                                                                                                                                                                Chrome Cache Entry: 829

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):552
                                                                                                                                                                                                                                Entropy (8bit):4.4354471280851335
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4tM65JA+KtIeDBmtMsZkvRP8x0iup0LELeyw5c+QU:t4tMMJALH8MsqJUtDoie+QU
                                                                                                                                                                                                                                MD5:A57A74B00971D94B2CCA706685A9FBF6
                                                                                                                                                                                                                                SHA1:8F24E8FAB4F92F58C23D451C3C8C6966C3A7B3E2
                                                                                                                                                                                                                                SHA-256:2C13665427EA079DB0437534FD5C3F43E144D4707F129267C56F0352FF582EC0
                                                                                                                                                                                                                                SHA-512:0A64ACB3697FBF5EC6A6D8DC46587E1A2A044F43D8DE0168F733B6276101F4A623D494E250D0C60A9E76C556ED288014530401A7C42F00F6CF5CBBE4AAD30748
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-share/v2/32px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M17.7375 5.26556L28.6745 15.2624C29.1083 15.6589 29.1083 16.3422 28.6745 16.7387L17.7375 26.7356C17.0958 27.3222 16.0628 26.8669 16.0628 25.9975V21.6217C16.0628 21.6217 16.0627 21.6217 16.0626 21.6217C9.92564 21.6217 6.69114 23.9378 5.1615 25.5968C4.80726 25.981 3.97329 25.7343 4.00015 25.2125C4.22558 20.8321 5.86088 10.8892 16.0626 10.8892C16.0627 10.8892 16.0628 10.8892 16.0628 10.8892V6.00368C16.0628 5.13426 17.0958 4.67898 17.7375 5.26556Z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 830

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):231
                                                                                                                                                                                                                                Entropy (8bit):5.077824311544019
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4G93gkIk6wy7Ndc8:t47N9U/vmRk3gBnV
                                                                                                                                                                                                                                MD5:455D4C6D10C83A1C3F62725C71F25BB9
                                                                                                                                                                                                                                SHA1:61F339D3E56879E1B4680D7229BF8B88BE9CBC8D
                                                                                                                                                                                                                                SHA-256:7834ADC55F57ED2863E9F0BF3D4944458EDD13D85F3207F7FE8BA2B2BFFBA464
                                                                                                                                                                                                                                SHA-512:C0C7A0378A799AB3D867B4FD63D6133564E1BB35C797D59DA621B235A73C18D4B90E308731CD09A1731175212D75CF9CDA31DF539230048BA60108A1069E8673
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/flag/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m13.18 4 .24 1.2.16.8H19v7h-5.18l-.24-1.2-.16-.8H6V4h7.18M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L14 3z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 831

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):151
                                                                                                                                                                                                                                Entropy (8bit):5.020176826819927
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHqJtxTcR+NkzlFWttxci:tI9mc4slhohC/vmI4ItxTcM6D0Ci
                                                                                                                                                                                                                                MD5:ABCB07D23B020A9464DD70FA10C0D9D3
                                                                                                                                                                                                                                SHA1:38EC787E83181D5907C71676C2C4A21EF4D5B72D
                                                                                                                                                                                                                                SHA-256:D721B8669114FBCDA49F612047DC68869FD406A82AC9BAA420ECF35FFEB05C2E
                                                                                                                                                                                                                                SHA-512:5218BB6A31E50DA5F42ADD673562C03B970C77FC85E9037ECB85ED9B005015EB754017B27351F04DA7622FBE2EED0CC4CCCF82CF73F6EFAD6C1665789AFD9E51
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/copy/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19 6v15H8V6h11m-4-4H4v16h1V3h10V2zm5 3H7v17h13V5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 832

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):165
                                                                                                                                                                                                                                Entropy (8bit):4.914928959846639
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcH0wvl7MJJTTtX+nIVrtXypS0:tI9mc4slhohC/vmI4PSTTl+n8le7
                                                                                                                                                                                                                                MD5:A64DE7E4B8E12D0201357414E2ED618D
                                                                                                                                                                                                                                SHA1:2DEE7B56217F540787CA82D03AB6171D08E23BE1
                                                                                                                                                                                                                                SHA-256:BA0D0E7E11AC72A801626946BE1B061DD59D990DD33077A37A08149917A7E930
                                                                                                                                                                                                                                SHA-512:A947F3619B2150621376D0CAC479AB6F522CAE7E651A917565050A4BC5ABCE6E60B3652DAC4D1CF90C0255FA09FC8EAA9B31EB6EF6A23D2E31AB497C86AAACB4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/list_play_arrow/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M15 19v-8l7 4-7 4Zm7-12H2v2h20V7Zm-9 6H2v-2h11v2Zm0 4H2v-2h11v2Z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 833

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):5430
                                                                                                                                                                                                                                Entropy (8bit):3.6534652184263736
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
                                                                                                                                                                                                                                MD5:F3418A443E7D841097C714D69EC4BCB8
                                                                                                                                                                                                                                SHA1:49263695F6B0CDD72F45CF1B775E660FDC36C606
                                                                                                                                                                                                                                SHA-256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
                                                                                                                                                                                                                                SHA-512:82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.google.com/favicon.ico
                                                                                                                                                                                                                                Preview:............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

                                                                                                                                                                                                                                Chrome Cache Entry: 835

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (65528), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):95538
                                                                                                                                                                                                                                Entropy (8bit):5.436334510106879
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:8Aa0TZtPgFqdho7ia+2O9UMyc9nh7Hq2E:LTZtYFwF95ycFJKX
                                                                                                                                                                                                                                MD5:727CBFA3B7290D35E267891F582F88B1
                                                                                                                                                                                                                                SHA1:AA9B4CE6826B46DB56E8FCAE0D1284248BF6C278
                                                                                                                                                                                                                                SHA-256:A5951034FFBA6569EF62BEFC21854C90CD987F3935BF1826E5455ED47EECB5E2
                                                                                                                                                                                                                                SHA-512:271A8A1D392C81490D01079F8C9C9856ED3E73CC552895B9C290E19CB06E953D247FE410A5641B95801109E4DDC65C98F8335E8236E83195B4BF0BE0E61808C4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/6s06vlv92ffjugj7k5xnkp5m9
                                                                                                                                                                                                                                Preview:!function(t){var e={};function n(r){if(e[r])return e[r].exports;var o=e[r]={i:r,l:!1,exports:{}};return t[r].call(o.exports,o,o.exports,n),o.l=!0,o.exports}n.m=t,n.c=e,n.d=function(t,e,r){n.o(t,e)||Object.defineProperty(t,e,{enumerable:!0,get:r})},n.r=function(t){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(t,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(t,"__esModule",{value:!0})},n.t=function(t,e){if(1&e&&(t=n(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var o in t)n.d(r,o,function(e){return t[e]}.bind(null,o));return r},n.n=function(t){var e=t&&t.__esModule?function(){return t.default}:function(){return t};return n.d(e,"a",e),e},n.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},n.p="",n(n.s=114)}({0:function(t,e,n){"use strict";n.d(e,"j",(function(){return u})),n.d(e,"x",(function()

                                                                                                                                                                                                                                Chrome Cache Entry: 836

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):484
                                                                                                                                                                                                                                Entropy (8bit):4.378279176071406
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4noU/vmRhChc2LX7pC52k+N4ezW0qw9DIRSY:t4oU/vYqVG2kCCw2Rz
                                                                                                                                                                                                                                MD5:2739BB8635C4631E78B240C8B83D102A
                                                                                                                                                                                                                                SHA1:38B8FDB6A8444513D18378E789547B377CA46DDB
                                                                                                                                                                                                                                SHA-256:FDE8C85A62FB4E29C3CD902167B791D0D06C3AEEF85C8DDDF3212287FB771A0B
                                                                                                                                                                                                                                SHA-512:A2A5F5AF163E487943608C9646A6F30BF870607FC7753C14621BC9592483713D9E2F4B40A63030AC820F56E310D3116E78E3E959AD869E9F77FFE9EC6C133CD8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/gear/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M19.56 12c0-.39-.03-.77-.09-1.14l2.19-2.13-2-3.46-2.92.83c-.6-.48-1.27-.87-2-1.14L14 2h-4l-.74 2.96c-.73.27-1.4.66-2 1.14l-2.92-.83-2 3.46 2.19 2.13c-.06.37-.09.75-.09 1.14s.03.77.09 1.14l-2.19 2.13 2 3.46 2.92-.83c.6.48 1.27.87 2 1.14L10 22h4l.74-2.96c.73-.27 1.4-.66 2-1.14l2.92.83 2-3.46-2.19-2.13c.06-.37.09-.75.09-1.14zM12 16c-2.21 0-4-1.79-4-4s1.79-4 4-4 4 1.79 4 4-1.79 4-4 4z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 837

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 405x720, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):38618
                                                                                                                                                                                                                                Entropy (8bit):7.995889821534109
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:768:x8SmpL12014fGeINyW3Y6qxEHn+2/2efbY2zZ6BQ/E0ZeTEPSPWgBv:XAhhi2yhhGn+M2eV6B4EMFgBv
                                                                                                                                                                                                                                MD5:D8865868EE124FAC0FCD9438B5FA3B24
                                                                                                                                                                                                                                SHA1:C1DA504D50E188D6B18C485F57291E70FB016547
                                                                                                                                                                                                                                SHA-256:E24E4D5C71ACADAA5092DF0ABE719232D6D3819B879DB9CE5C3D8092FD4727EF
                                                                                                                                                                                                                                SHA-512:1082F247BD20EAE5E10AAE60B120F78E9062A92B4378168A6D39597A6EF1A126EF392A2EE8DC47A45B31F47939EAB58F4D0033213D7D2D2DFD0BE5B8EB3ED6C8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/ZAOoIrHdJ4Q/oardefault.jpg?sqp=-oaymwEdCJUDENAFSFWQAgHyq4qpAwwIARUAAIhCcAHAAQY=&rs=AOn4CLCn8V2U3bKQbFkKpsoMe8dy4ZAcVA
                                                                                                                                                                                                                                Preview:RIFF...WEBPVP8 ...0....*....>Q".D..!.+.<0...gn*EP.6..@...2........\...Ow.P.N...O>>......w...o....`.....K...c.;..'.^.}..K.!.i...Q.........=.W.?.y.......{).......?........../N..8.....s.....9..3...s..7_........4.W..U..XM{.z^.O.^pqf..$%.V..X.n..,....J.g.I.F..vem=>_.o0Y...s.|..*.......Y#......W.....W...N.'........).F....E...9.....y....n...F..!!.<.1.... ....x..[.A.aY.o.~.]b....<c...Nk..[.\.........W...f.1...._......3.........C't#....K.......3 .!..!......MmS.bD.;..2O/.J.m.p..D.....WrJ..............h.]..b....F.......V.`N^,9R......C......*!....>/}.=..K...z..:i...!..U...W.r.....Rg$.`.G.K=......t^....0.Q..S..{(.7f.H..B....,...."%.....nZ....R..q.d.....L.......2.}.X..o...(..nY.....j......i.]..^..$.d....Hm.....u.u..m..<X(_.. t.:...yH7dS.t.....*..R..L...J....{~n.B.Q}.TE.{=.w..z.e..}M.P.I.....s.ji_...\.w....#^.e7F.....S..gH.F....]&._....i.u..~...d..4!c.Ubg([6u....V....~.|.e.2....,.<:.s.$`.R$%(..7.... .)A.=....E&.....@.W.)...:g.....<.uZo2..i6.W..9....

                                                                                                                                                                                                                                Chrome Cache Entry: 838

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):114292
                                                                                                                                                                                                                                Entropy (8bit):5.5528653263166285
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:BfaN1hvawAB3MAYcKh+CY0YcQ1rFPyY5c/F1FRLf+aD3Wp94yXCQC4NIT3PTtSGa:BfaNbAB3IacQLiPFRLf+e3g9bXcAITk
                                                                                                                                                                                                                                MD5:EA5144AB403234BE650A76530D1CB29D
                                                                                                                                                                                                                                SHA1:67DEE97C0AE2F912CE9F4CB1ADB9181857A01DF3
                                                                                                                                                                                                                                SHA-256:6EA25790432AA3DF786FF6518EAE8400D61081EE2A2206082C24B3FC6D4705DF
                                                                                                                                                                                                                                SHA-512:74998F4A928418639BCC2C4EE5BE2DABDC01D5D4C5E3C69BA606E9A0757D173EC542BBD3BD2CFC31CBC17057B421773778997A80F1C4925022DEE0A0B4CA0241
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var Atb=_.y("ltDFwf");var AU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.$r(this).fc(function(){this.Fa.length&&(this.Fa.forEach(this.f9,this),this.Fa=[]);this.La&&(this.La=!1,_.Bq(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.Bq(this.mb,"transform","scaleX("+this.ja+")"));_.$q(b,"B6Vhqe",this.Ca);_.$q(b,"D6TUi",this.ta);_.$q(b,"juhVM",this.Ma);_.$q(b,"qdulke",this.aa)}).build();this.ea();_.zg&&_.$r(this).fc(function(){b.ob("ieri7c")}).Ae().build()();_.ez(this.oa().el(),this.Sa.bind(this))};_.B(AU,_.J);AU.Ba=_.J.Ba;.AU.prototype.Sa=function(a,b){Btb(

                                                                                                                                                                                                                                Chrome Cache Entry: 839

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2270287
                                                                                                                                                                                                                                Entropy (8bit):4.924226738718404
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12288:NRpaQ+5+Fmt9CKkqFOdJ/JGfeiwtHWTOev3z69JGFez0TDJmgbVrdUto/4Q/5mKh:7o/4Q/5mKkKna0B
                                                                                                                                                                                                                                MD5:28A33C27FEC758DCEF4F64FE33CE3FA3
                                                                                                                                                                                                                                SHA1:6A79CC1ADE760CC79167A9E832F7DFA3C4C65C80
                                                                                                                                                                                                                                SHA-256:0FC12A610E554A6A90474F79D7B0BB352302D66C96547C326A61144F2AA28099
                                                                                                                                                                                                                                SHA-512:174F89D654523DA6B133A452BBCD3D36CB582ABB8099B950DE64F1B9228FDEA9B16AD2CF4D3C803DF2D3B7B8C4A3766323B3AA4D8E9F593F999C76DFF3066762
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.KWxblPF3ops.L.B1.O/am=AAjQAg/d=0/rs=AGKMywF7-tDpt3JY3IfFWrYKJ3CYN-IL2A
                                                                                                                                                                                                                                Preview:.lottie-component{display:block}.yt-spec-icon-shape{display:flex;align-items:center;justify-content:center;width:100%;height:100%}.yt-core-attributed-string--inline-flex-mod{display:inline-flex;height:1.4em;vertical-align:middle}.yt-core-attributed-string--inline-block-mod{display:inline-block}.yt-core-attributed-string__image-element--image-alignment-bottom{vertical-align:bottom}.yt-core-attributed-string__image-element--image-alignment-baseline{vertical-align:baseline}.yt-core-attributed-string__image-element--image-alignment-vertical-center{align-self:center}.yt-core-attributed-string__link{text-decoration:none}.yt-core-attributed-string__link--display-type{display:inline}.yt-core-attributed-string__link--call-to-action-color{color:#065fd4}.yt-core-attributed-string__link--overlay-call-to-action-color{color:#3ea6ff}.yt-core-attributed-string--link-inherit-color .yt-core-attributed-string__link--call-to-action-color{color:inherit}.yt-core-attributed-string--highlight-text-decorator .

                                                                                                                                                                                                                                Chrome Cache Entry: 842

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):511
                                                                                                                                                                                                                                Entropy (8bit):4.622942488641842
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:trwdU/gKup+tiHD6x2wiHDXx2wiHDi25iHDV25iHDc:tYU/duItq68wqMwqt5qw5qc
                                                                                                                                                                                                                                MD5:A229E3CF403001E92CB1EA441D880E54
                                                                                                                                                                                                                                SHA1:1C4518AA326967D4BC424FD14C65D1A3276B5100
                                                                                                                                                                                                                                SHA-256:952AC1A0AE07753F75FA27BBE483E71C43B29DF5C160AAE33BB447C0E5B5E751
                                                                                                                                                                                                                                SHA-512:6B30EE9BECA55C6FC5A92330CEB5AAA3F70E1B1A166A6CE7FF0059F619F525673B8160D2A6D35E6D6B35CB52FDB547F3EEB8F960B2E7356C4C2C699115FEBA66
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/waveform/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">.<rect x="11" y="2" width="2" height="20" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="15" y="6" width="2" height="12" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="7" y="6" width="2" height="12" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="3" y="10" width="2" height="4" rx="1" fill="white" fill-opacity="0.3"/>.<rect x="19" y="10" width="2" height="4" rx="1" fill="white" fill-opacity="0.3"/>.</svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 843

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1727
                                                                                                                                                                                                                                Entropy (8bit):7.139913067978
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:gjQliWYMVOGaVw4ag6DWamL1fsecfKsAk4vR:xVO/VwFVDWa8sKk4J
                                                                                                                                                                                                                                MD5:3F8807B6795722EF4EA249939DB27173
                                                                                                                                                                                                                                SHA1:451C4EE7FA18C64AE191BEC303CFBD1E44F8094A
                                                                                                                                                                                                                                SHA-256:BE96937B9076B80C07152546C5DBE104ABF93AA5C7A05A3B680BB2AD2190F484
                                                                                                                                                                                                                                SHA-512:A748FF83C8985CE9FBD25B93C7E862CFB2B1BAADC70EE3CA736DAFABB6154D8F6523119C2D488730FE1CA598AB0C394455344167574F9B77153191836A9CF806
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/424600410_10224218622549556_3942846447045467612_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=UK_RG-U-NvYAX9-gjzq&_nc_ht=scontent-lga3-2.xx&oh=00_AfBiT70X_O4EyWMA-cc7x5PKeHb1I7l-RO9TODn9CyAGjQ&oe=65DB2EA6
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e301000085020000cf02000020030000f2030000be040000f50400003505000080050000bf060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."............................................................................Q...oCZ.....3'.K.f.a...,.A.g.(..N'>..F.+...hU.?..Vus..`!.=......... .............................!...........Ry"?}el....9.U.K.~."i...L.1.Mh,!.J-l.......wV{+<M...k.7.@.k....Z*u....m..V.f.[FNM....c..z....w=.V.rp..<&X8L.....=.... .......................!... "1........?.D....&..\.a....gZA}K..:..................................! 1Q........?...n2I..s....d..8G.&.Z\.....,.......................!1.."#aq.2Q..0A............?.q.;.....n...2.r=..4.........Af.YMZ.;,.....B..C....m6e7....N3...jHZ..P.wB....*v9...s........{.|.......!.4..v>."....\$7..c....1.}.m.Is..\..v...y.-_.?...%....................!1QAa

                                                                                                                                                                                                                                Chrome Cache Entry: 844

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                                                Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.google.com/pagead/lvz?evtid=ACd6Ktwitc8XCqsz8xAbQmu85eXWgA65u9gEyRTd1wxRrsgOqpnXxmctQNupTwwCrql9TrIbVB7CvYHjJqo2TLUcivjQtZKDAw&req_ts=1708479609&pg=MainAppBootstrap%3AHome&az=1&sigh=AB9vU42Dw6PBjTmBKndEzM69nCiOvSjfvA
                                                                                                                                                                                                                                Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                Chrome Cache Entry: 845

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):264
                                                                                                                                                                                                                                Entropy (8bit):6.909369303018702
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:6v/lhPK36Sj1mDOAsEoTtCisY6XdjtiKWDbka1fO9sup:6v/7iqeK8Ci565srbUD
                                                                                                                                                                                                                                MD5:802B5AA3DDBBD128AEA160F1A34C4C8D
                                                                                                                                                                                                                                SHA1:355F27C6F73E934DFAAC9A30F46801088FD4AE04
                                                                                                                                                                                                                                SHA-256:A3D392C82856C904FCFE02DC05C746DD74778725F7588EEF570EDD134633D32C
                                                                                                                                                                                                                                SHA-512:868490C15057FACC0315DDC041BE1A666BD7AE78A7F880018444204A7A659F4EA49678577EC9179907AA6FA71145FD582B3850AD12033F030F5E431091C2DED3
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/web/monochrome/logo_32x32.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR... ... .....szz.....IDATx......0...9.iNs.S..R..eu.....8.)N.I.]n.4{iR....6.]....N...7...X3.$.,....}kHm:.w p..<...,..xsC}F.X.o..^....G......;.2.......].O.......d*. .g.:.c..G`.....#.(.P...y,z..U..5o..HdI...8.Xv.b(..C..J.....K........IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 846

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (4982)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):52506
                                                                                                                                                                                                                                Entropy (8bit):5.446250274482012
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:ETsMRensj20tJ9Z5Q6K3uwSXiRc0Pj+P3fPO:ETcnsjDJtQ6K3urNajcfPO
                                                                                                                                                                                                                                MD5:F833E6B292F7240CC8A49C3FCE063EA8
                                                                                                                                                                                                                                SHA1:193958C5C91BBC902799CFEF02101D5F19ED7F55
                                                                                                                                                                                                                                SHA-256:FDC143BE95EB2A0348888C7231F2089FA95A1F07D93FABC18D87D314590CE21E
                                                                                                                                                                                                                                SHA-512:40BEC0871299562048FAF8305BD0C9BA0ABBF53554BB1047DF4474734ABB6700B6924F3ED828AAEAA3DDB9771894046A6907C4D1E166B62796BAFC4D3E89F50C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iFd24/yZ/l/en_US/EbDu0qzCCoR.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("useCometTextDirection",["UnicodeBidi","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=(h||d("react")).useMemo,j={LTR:"ltr",NEUTRAL:"auto",RTL:"rtl"};function a(a,b){return i(function(){var c=d("UnicodeBidi").getDirection(a,b);return j[c]},[b,a])}g["default"]=a}),98);.__d("CometRoundedTextInput.react",["BaseFocusRing.react","BaseTextInput.react","CometScreenReaderText.react","Locale","react","stylex","useBaseInputValidators"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i||(i=d("react"));b=i;var k=b.useId,l=b.useState,m={backgroundPlaceholder:{backgroundColor:"xmjcpbm",$$css:!0},backgroundSecondary:{backgroundColor:"x1qhmfi1",$$css:!0},disabledInput:{color:"x1dntmbh",cursor:"x1h6gzvc",$$css:!0},endIcon:{paddingEnd:"xsyo7zv",paddingLeft:null,paddingRight:null,$$css:!0},fontPlaceholder:{color:"x12scifz","::placeholder_color":"x2s2ed0",":focus::placeholder_color":"xq33zhf",$$css:!0},fontSecondary:{color:"xi81zsa",$$css:!0},hideIconAnimation:{transitionDura

                                                                                                                                                                                                                                Chrome Cache Entry: 848

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):648
                                                                                                                                                                                                                                Entropy (8bit):4.380679704687561
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4noU/vmRfhAZY75jQOglOfYcgUKa1rTdnSbzUMoElCInaGLKphWXpVn1:t4oU/vCOa75cOglOfWUzddnSXkUaGLYS
                                                                                                                                                                                                                                MD5:3DFBA54305D790EEE8D1ED17694E3796
                                                                                                                                                                                                                                SHA1:8D0B1DDEE9A50BA3AAA040F11859C2543325C97F
                                                                                                                                                                                                                                SHA-256:BDBC7B228AFDC12B4290348DEE94F07413262E4EAC967AB91946823E45710748
                                                                                                                                                                                                                                SHA-512:0FDBB45059C9036353594B3D4F5CEDC908AA5FB332B594D66C654821BFF09E50C739E274B744CFCD5F91ACF2B39D190E2B32EC84697EA9F04FB6A2720F9E7291
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/volume_off/v4/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m3.15 3.85 4.17 4.17L6.16 9H3v6h3.16L12 19.93v-7.22l2.45 2.45c-.15.07-.3.13-.45.18v1.04c.43-.1.83-.27 1.2-.48l1.81 1.81c-.88.62-1.9 1.04-3.01 1.2v1.01c1.39-.17 2.66-.71 3.73-1.49l2.42 2.42.71-.71-17-17-.71.71zM11 11.71v6.07L6.52 14H4v-4h2.52l1.5-1.27L11 11.71zm-.67-4.92-.71-.71L12 4.07v4.39l-1-1V6.22l-.67.57zM14 8.66V7.62c2 .46 3.5 2.24 3.5 4.38 0 .58-.13 1.13-.33 1.64l-.79-.79c.07-.27.12-.55.12-.85 0-1.58-1.06-2.9-2.5-3.34zm0-3.58V4.07c3.95.49 7 3.85 7 7.93 0 1.56-.46 3.01-1.23 4.24l-.73-.73c.61-1.03.96-2.23.96-3.51 0-3.52-2.61-6.43-6-6.92z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 849

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (5842)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):13005
                                                                                                                                                                                                                                Entropy (8bit):5.385476614866472
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:EGPzF/Z8FjmrWX8oDfc/xkiF55npVKyGT5xRNElQQx0JLNThA+dW51So:Bj8FarWX8oDfcFFDnpVKyGdxRNElB1Ye
                                                                                                                                                                                                                                MD5:E1AD4E3D26CC72E49609FCAD39B4AABB
                                                                                                                                                                                                                                SHA1:1D353A2E2E9C24C12A938C9EC8DEC48D87C6C420
                                                                                                                                                                                                                                SHA-256:9AE20AB072694E627FC333C4514E5429B8BF47477F3886D9D0BE00FA5DCFDCAA
                                                                                                                                                                                                                                SHA-512:5B7026F39184ACB8CFCBFA4C5528595F209A97E3F2FEFEA752BCAF6D0922A719EAD8706A3C8C42D37EA364B3E9CBACE687D72B0D1BAF614B690D0B14515C45C0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3idBq4/yT/l/en_US/nYVb1eL2wQQ.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("BaseToast.react",["BaseInlinePressable.react","BaseTheme.react","BaseView.react","FocusRegion.react","focusScopeQueries","react","useCurrentDisplayMode"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||(h=d("react"));b=h;var j=b.useId,k=b.useMemo,l={dark:"__fb-dark-mode ",light:"__fb-light-mode ",type:"CLASSNAMES"},m={item:{display:"x78zum5",flexDirection:"xdt5ytf",paddingBottom:"x19yoh24",paddingEnd:"xpowjs8",paddingLeft:null,paddingRight:null,paddingStart:"xrxijuk",paddingTop:"x6enp1t",$$css:!0},itemText:{flexGrow:"x1iyjqo2",$$css:!0},link:{wordBreak:"xdnwjd9",$$css:!0},root:{alignItems:"x6s0dn4",backgroundColor:"x1wkzo03",borderTopStartRadius:"x1192kqh",borderTopEndRadius:"xjfsc2c",borderBottomEndRadius:"xg8fqjl",borderBottomStartRadius:"x1kdh5me",boxShadow:"xi1c1fh",display:"x78zum5",flexShrink:"x2lah0s",maxWidth:"x1cs6qxi",minWidth:"x1hqenl9",paddingStart:"xuv3zuj",paddingLeft:null,paddingRight:null,paddingEnd:"xd3owfx",paddingTop:"x192rfv7",paddingBottom:

                                                                                                                                                                                                                                Chrome Cache Entry: 850

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (4199)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):19218
                                                                                                                                                                                                                                Entropy (8bit):5.386483333795039
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:audfEIMCVf6W/vtvayL5sDU/SkZKjAUpSiLw9UpYCjIgk9uzBi:ffL6W/vtvawsY/8suSr9UpYCjIgk9uFi
                                                                                                                                                                                                                                MD5:C8734A39BAC01098267A643B9D728D22
                                                                                                                                                                                                                                SHA1:33964CFF7039C268CA4432FC3F69A2B096D09D7A
                                                                                                                                                                                                                                SHA-256:505708C0E484FFF76A2CE4C98F2923DF33AB6D1F6DBCBFAB2AA083F46D78C7B6
                                                                                                                                                                                                                                SHA-512:18EC4598C30BFA490DBCAE1B73D2E451CD7853458CDD0B7E0473B91F0FA5F6E8E02FA2C504F2D99B4221C0D80170005FDFA3CA3EBFA4DC38EABDC68FDB543DCD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Ou=function(a){this.Ga=_.t(a)};_.B(_.Ou,_.v);_.Pu=function(a,b){return _.gd(a,3,b,_.sc)};_.Ou.Fb=[1,2,3,4];.var ABa=_.da.URL,BBa,CBa,EBa,DBa;try{new ABa("http://example.com"),BBa=!0}catch(a){BBa=!1}CBa=BBa;.EBa=function(a){var b=_.hh("A");try{_.Zd(b,_.Td(a));var c=b.protocol}catch(e){throw Error("cc`"+a);}if(""===c||":"===c||":"!=c[c.length-1])throw Error("cc`"+a);if(!DBa.has(c))throw Error("cc`"+a);if(!b.hostname)throw Error("cc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};DBa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host=.b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.FBa=function(a){if(CBa){try{var b=new ABa(a)}catch(d){throw Error("cc`"+a);}var c=DBa.get(b

                                                                                                                                                                                                                                Chrome Cache Entry: 851

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):211
                                                                                                                                                                                                                                Entropy (8bit):4.924417291349329
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4mqUEUKFI8mRKuw6Y8:t4noU/vmREaI8Kw6Y8
                                                                                                                                                                                                                                MD5:DBF72CAC4571210883C7748A6E8B9C71
                                                                                                                                                                                                                                SHA1:984DFE134C779FD952ED67C1CEAB88D14FDCF122
                                                                                                                                                                                                                                SHA-256:62714BADF737F2D069588724ADE1CB6B79AEF821C432875C614997E351F76341
                                                                                                                                                                                                                                SHA-512:AD53CBDD55542FCCD83387639BAD59372949B1933F603B44EB6859F1EB344B8F2F11241EC954628F9025E88CB308F67051C408151800176B45F49A398140744E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/clapperboard/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m22.01 4.91-.5-2.96L1.64 5.19 2 8v13h20V8H3.06l18.95-3.09zM5 9l1 3h3L8 9h2l1 3h3l-1-3h2l1 3h3l-1-3h3v11H3V9h2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 852

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):473
                                                                                                                                                                                                                                Entropy (8bit):5.240157994693449
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:kxeXjxeX4wFbcloiHKobO4xMl23ZhVgBDKDi7e8kbRNfeX60:kMYDRiqobPxi2fVgB+XprGJ
                                                                                                                                                                                                                                MD5:13782B3B1A5B6B82B186225398C96C55
                                                                                                                                                                                                                                SHA1:AA9E89FABF00C27173190096499F47FAEE56C684
                                                                                                                                                                                                                                SHA-256:1EAF3863ADA2FC1BC5C99F0731313B8046C576403EC8721757F935B8245C2C26
                                                                                                                                                                                                                                SHA-512:D966BA31E97827381C2F26E9DC069A6DA26EFFEE26AE9C1965A73C1CFB4A852A6F4C94BF60B1F33719A3AF522CA0B868D99833E422FDEAD8644BD527118AE685
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=XiNDcc"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.HIa=_.y("XiNDcc",[_.Nna]);._.k("XiNDcc");.var DI=function(a){_.J.call(this,a.Ha);this.aa=a.Ea.ez};_.B(DI,_.J);DI.Ba=function(){return{Ea:{ez:_.CI}}};DI.prototype.kB=function(){_.b3a(this.aa)};_.K(DI.prototype,"IYtByb",function(){return this.kB});_.M(_.HIa,DI);._.l();.}catch(e){_._DumpException(e)}.}).call(this,this.default_AccountsSignInUi);.// Google Inc..

                                                                                                                                                                                                                                Chrome Cache Entry: 853

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (20386)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):24922
                                                                                                                                                                                                                                Entropy (8bit):5.5370745516072795
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:bWrUnwzqiCXznnxmmUCf9zTvJFZ5KDHjC6:bmUjznxmmUwZ5F6
                                                                                                                                                                                                                                MD5:30B79BF5D6570CEE86DFB7C421578ADB
                                                                                                                                                                                                                                SHA1:2BD11C936F781184EB59A7219D7136395F21A7F8
                                                                                                                                                                                                                                SHA-256:70916F59D136472CA5E1016A3922022793EE5E4ECEB5C047A27BCA3936EFFCE8
                                                                                                                                                                                                                                SHA-512:172E59AE301E70957F1D328A3DE1BA16AE2C8EB553B6E19EEE3E60D497BD5D74319D143AFC3E290DFE683149C47266D980459A8D539A714E8781754D1BEE175F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/y9/r/O_4AXgPZeIL.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometPageLayoutWithComplementaryContent.react",["BaseRow.react","BaseRowItem.react","CometMediaViewerFullscreenContext","CometRouteRenderType","CometScrollView.react","MWChatVisibilityOverrideContext","gkx","react","stylex","useMWShouldCurrentRouteOverrideChatVisibility","useShouldShowMessagingEntrypointOnCurrentRoute"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i||(i=d("react")),k=i.useContext,l=c("gkx")("20935"),m=c("gkx")("21050");b={chatSliver:{backgroundColor:"x1jx94hy",boxShadow:"x13tw4yp",display:"x78zum5",height:"xtp0wl1",top:"xxzkxad",width:"x1dmp6jm",zIndex:"x1vjfegm","@media (max-width: 899px)_display":"x1daaz14",$$css:!0},container:{height:"x3igimt",maxHeight:"xedcshv",overflowX:"x6ikm8r",overflowY:"x10wlt62","@media (max-width: 900px)_flexDirection":"x10o2a94",$$css:!0},containerFullScreenInPushView:{minHeight:"xg6iff7",$$css:!0},containerInPushView:{minHeight:"x1us19tq",$$css:!0},containerNotInPushView:{minHeight:"xat3117",$$css:!0},contentAre

                                                                                                                                                                                                                                Chrome Cache Entry: 854

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):56448
                                                                                                                                                                                                                                Entropy (8bit):7.977429793250503
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:tJkBYneluCT7TrT6F03QkBzaUUk84cskOpSasD+jn:tJkOnrCTn6F03lzaUUk8dJPasCn
                                                                                                                                                                                                                                MD5:14D771ADF5D8F23A57C1848A019CD1A0
                                                                                                                                                                                                                                SHA1:C17431364F6B7154FE07220DA92DB8E61CA3D7D6
                                                                                                                                                                                                                                SHA-256:D27096D0C103CB65872E70C803CF8BE277176104B801B8BD0B6DA9F5AD3F7C7B
                                                                                                                                                                                                                                SHA-512:61A4782B749C9E489060632CF10C3B3A260966F2C92D1BF3237793854F4BEA6E6F167A57AD6630DF11702044F5501173E0485934946CFB9FCC096E910817CA29
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426200285_1121363335685685_2373091845312896658_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=eD0drtUpndwAX_HTkht&_nc_ht=scontent-lga3-2.xx&oh=00_AfDGhhQEJn0Q1EEZZjIvBjT8eOQh_A0cYorCvh17ZVvaTQ&oe=65D986C4
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000d81d0000843d0000c9430000b1490000fb5300007e7a0000b480000050890000cf91000080dc0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...............................................................................+d...a....I...f.......,x......^.^.z..`\....B....M..U}.y..M#... u.....J,..-@@`.p.$dR...SW*^.....@.@......En...2%.H0(0D...6..Gns..`U.b.4.4X.`.3>N.G..gN{y...%.....X .@C...B.H'UVX.....V.....I.+..=.M...j.X+..!..SR.L......G...Z..s..*N..&...3.5.f<=.x~.(...}.p..k....@B .u.....B..Q|2...+5.`.....@,.8.P.KF.ZZ....Y....a . .R......9v.)...........5<.5.WX..{.%.9d.I.E(...0...2 ..u.....(k.....K.X...."..2A..s.=\.l..t1M!..0....;.F......59.......Xb.r......<...c./.:..S..[]($....3k....C....KX...v...\...M.d.J$.r..B.$........8,.....'..v..khM....3>..R...-.5....\...q.Y....lQ,..LbN....:`9Q.b4......%.."n.

                                                                                                                                                                                                                                Chrome Cache Entry: 855

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 405x720, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):23236
                                                                                                                                                                                                                                Entropy (8bit):7.99129812279775
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:384:eMA/a/04aiaDdl/4hw1i3IUrHfPndhjUXRUFGBFu+po05s:dACaN5qBrrHNa+oC+po0G
                                                                                                                                                                                                                                MD5:69356642206F607E1E6C8B228CFCBC81
                                                                                                                                                                                                                                SHA1:78F6F5DBB4E26D16853B59BE72BE4714A691FF57
                                                                                                                                                                                                                                SHA-256:423F568D231B89C8B2047D06E0B58846DADC0AF78C7CEC6C822B6DF67C4532CD
                                                                                                                                                                                                                                SHA-512:E41E016A0E34429495EE8F6203E12B227758765CEA85C54BFE53C70980314781DC52A30066567CD211AABF1BF64371DB1161094A5A23C07023B742705ED39B03
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/B2HfbSBv0ao/oar2.jpg?sqp=-oaymwEdCJUDENAFSFWQAgHyq4qpAwwIARUAAIhCcAHAAQY=&rs=AOn4CLCbCJ0wbjBDXjkw_bZ1LX6GtnYjaA
                                                                                                                                                                                                                                Preview:RIFF.Z..WEBPVP8 .Z.......*....>Q$.F#.#.#.z. ..g-....L. ..fS.?..a.E.by.~....9.rC..5|../...oa..|........>.t..../........._A....o.^...V.]......t=.}..........==?.....O..?...?.}.}.....g.?.{......o...O.7._.....{.............................'q1......q2a.RsYS./..%.8..].L..$..........o.C.l..xh....|%.j.q<...:...u..^....c.&%.. .....}...B..j.....@..r.)..r.|..C.c.W.y........F.H.K....:...J.N..H.Y...D.....r>...%n.n.../.P&t.9p.^.....AbSL.e...k.....d..]I..Y...V6..k&.x...%X.!W.i7...t.wn\i-..?=.MD.b^..as...I.%....-..y:f..8.,.F.:b.dwx..:.$4.a...#.../..b.........._Md..t....)...9....e..1.< J+.F|uU......ey!.8...XJ.....'..\..C...`.........}...5|`.Z~|.S.......g..T."....F....#......L.D\.........5.[.I.~...7..c ..n.$.....mC..x...T....Rok..&:\^h....&.....V_,..D55g....8..-.....D.=..~l.....D.....k.MO...)Tk-a..\...t...Vd..._.RG.YsT...^D..6...L)...D.."N....t=.QL......T...*..,........k..R.l(w.9..).7.V.)......$u......`R.........7>..:."g..=.....yP]..^b`.p;.......u.@.R.6.

                                                                                                                                                                                                                                Chrome Cache Entry: 856

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (19354)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1222477
                                                                                                                                                                                                                                Entropy (8bit):5.4643266472857155
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:5AL9fLzt985b0yfV4Ttflp53hQeODbAOAEJHGXlbyC5Z7gZ5dnXnNfM7clj75YDg:yRhyfEt9XS/DpJmXhyCT7anXnNpV4MG0
                                                                                                                                                                                                                                MD5:39E47D9EA50EE431AA0B826438A38C79
                                                                                                                                                                                                                                SHA1:ACDBDBAC24C838B75AF7BAA38534AC55F63195BA
                                                                                                                                                                                                                                SHA-256:580D5FF78DB2AC72B3B13637088546CA21BA3713DCA1C2B501F5D0A6592E0E80
                                                                                                                                                                                                                                SHA-512:C1331D0E210F8C078EF0A250AC0CE666CA0B17B2AE6EE745D025DAC6608FA6F96888EDD852D686B37380240E6383ACC37C6E38907E8725702FF6D3EF5715ED04
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iwSC4/y7/l/en_US/IzdAc3mTxen.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometStyleXDarkTheme",[],(function(a,b,c,d,e,f){e.exports={"fds-black":"black","fds-black-alpha-05":"rgba(0, 0, 0, 0.05)","fds-black-alpha-10":"rgba(0, 0, 0, 0.1)","fds-black-alpha-15":"rgba(0, 0, 0, 0.15)","fds-black-alpha-20":"rgba(0, 0, 0, 0.2)","fds-black-alpha-30":"rgba(0, 0, 0, 0.3)","fds-black-alpha-40":"rgba(0, 0, 0, 0.4)","fds-black-alpha-50":"rgba(0, 0, 0, 0.5)","fds-black-alpha-60":"rgba(0, 0, 0, 0.6)","fds-black-alpha-80":"rgba(0, 0, 0, 0.8)","fds-blue-05":"black","fds-blue-30":"black","fds-blue-40":"black","fds-blue-60":"black","fds-blue-70":"black","fds-blue-80":"black","fds-button-text":"black","fds-comment-background":"black","fds-dark-mode-gray-35":"black","fds-dark-mode-gray-50":"black","fds-dark-mode-gray-70":"black","fds-dark-mode-gray-80":"black","fds-dark-mode-gray-90":"black","fds-dark-mode-gray-100":"black","fds-gray-00":"black","fds-gray-05":"black","fds-gray-10":"black","fds-gray-20":"black","fds-gray-25":"black","fds-gray-30":"black","

                                                                                                                                                                                                                                Chrome Cache Entry: 857

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (18915)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):43237
                                                                                                                                                                                                                                Entropy (8bit):5.680707641754852
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:5RWw2BBHWtPd0h3A4LWhNzrXNAtU9ArbM+AI99yNIE:5QBZWtmw4LqPXNIU9ArbMP
                                                                                                                                                                                                                                MD5:A20A57297296210AE55C26306436FCE5
                                                                                                                                                                                                                                SHA1:AF8363C369F8FD23868093CE0FF02C8D88C229C0
                                                                                                                                                                                                                                SHA-256:2DE52103B1FEEB037AF1757A1D10CB77A335258410AFF50F3CC4B93589357FDB
                                                                                                                                                                                                                                SHA-512:E0BD233E5F75ECCC4D5018E1F7A4650D13BDD84D4DDCBB1BF482CB35CC836B85CE146F0A2B41DEA578CECF05FB8E7A6C9B6F28DC79A81801A9898B700860020C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yY/r/YT7n1sgH1lv.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/../**. * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/. */.__d("bignumber-js-9.0.1",[],(function(a,b,c,d,e,f){"use strict";b={};var g={exports:b},h;function i(){(function(a){var b,c=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,d=Math.ceil,e=Math.floor,f="[BigNumber Error] ",i=f+"Number primitive has more than 15 significant digits: ",j=1e14,k=14,l=9007199254740991,m=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],n=1e7,o=1e9;function p(b){var g,h,x,y=a.prototype={constructor:a,toString:null,valueOf:null},z=new a(1),A=20,B=4,C=-7,D=21,E=-1e7,F=1e7,G=!1,H=1,I=0,J={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xa0",suffix:""},K="0123456789abcdefghijklmnopqrstuvwxyz";function a(b,d){var f,g,j,m,n,o,p,q,r=this;if(!(r instanceof a))return new a(b,d);if(d==null){if(b&&b._isBigNumber===!0){r.s=b.s;!b.c||b.e>F?r.c=r.e=null:b.e<E?r.c=[r.e=0]:(r.e=b.e,r.c=b.c.slice());retur

                                                                                                                                                                                                                                Chrome Cache Entry: 858

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2958
                                                                                                                                                                                                                                Entropy (8bit):7.809015191551286
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:Ui2mkKQylEa/s23pE0G19843HzFzOSguSVTFiMzyKiR1LrOHsG8fhMF5L:CHKQy9r5E0H4zUSDSVRi83iRJKsj0
                                                                                                                                                                                                                                MD5:5D7662ACE7B9B61625D67A9886722123
                                                                                                                                                                                                                                SHA1:606E138FAB12D83862B9F4EDD57CA8DE73FD722E
                                                                                                                                                                                                                                SHA-256:2CB1195727CB71A2B86975C8CB8813EACA6012445EBF5A421140E939101F5ECE
                                                                                                                                                                                                                                SHA-512:F1A4723DA592A0CA1F239634194A165E994820C866488862DD41B35AFC73353D6047ABEDAAFF5594DF822C677553E9D68708F97D9EA1D9B46AB503E8F6F42141
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://yt3.ggpht.com/23TuXHVGFOQNJ--nGIH3sbX5Tt1pscojy3lHhHJB3T9IcowEFJHJqORL7o1Gw-4WrrLMFFknLQ=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                                                Preview:......JFIF.............*Exif..II*.......1...............Google..............................................................................................................................................D.D............................................3..........................!..1.".2AQa#q.3BR......................................5........................!1A.Qaq........B.2.."Rb................?.`....`9g.%.....!..<a&0U.^.v.A.....{.a.....T.}..<..F.f.......`Jl:..&.}j...v.C.4m@^.T'..$.mM.........s....{.tY+..wb..7...S.6<..-...e...O:..8.I..O.Y.....ok..2*..c.\ .3R...Q.J..Qv.(..].K.].{y...alJpyl:.2WTq..a&JG....mO.2x.P).MME:I.)3.u..rH.6.....H..7.....i5....`I.[.&.ef.sdD.<A00../..\..}.s*.b."I`x..+....-2H.Y..'.......Q`.K...(......{.:.....U.R..cGx*v.lf..Df.7.q..\qk.m....Sc..3v.38..9..6.Z.D^.p.Dby..5T.......a.......J.P.....~0.[.@.T..!..}BC.y..(jh.b.6.N.2...Hb...s1.6...'.,..Y.8..A...e[Yu...c\9..=..H.v.e..T..RM..4b4..".<1.eX*.I.q...F.g6.1.fx ......KOod@.Z....L...F.....$N.P

                                                                                                                                                                                                                                Chrome Cache Entry: 859

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 21464, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):21464
                                                                                                                                                                                                                                Entropy (8bit):7.991635778215233
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:384:kNMw20ZcZdIR049weTGXkBXju/W4irYjhPC09oOtbMDa9HVZycTvwxNTGup:UaxmXXSdiQPCjMvyugNiup
                                                                                                                                                                                                                                MD5:923A543CC619EA568F91B723D9FB1EF0
                                                                                                                                                                                                                                SHA1:6F4ADE25559645C741D7327C6E16521E43D7E1F9
                                                                                                                                                                                                                                SHA-256:BF7344209EDB1BE5A2886C425CF6334A102D76CBEA1471FD50171E2EE92877CD
                                                                                                                                                                                                                                SHA-512:A4153751761CD67465374828B0514D7773B8C4ED37779D1ECFD4F19BE4FAA171585C8EE0B4DB59B556399D5D2B9809BA87E04D4715E9D090E1F488D02219D555
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
                                                                                                                                                                                                                                Preview:wOF2......S...........St.............................*....`..~..<..u.....H........6.$..|. ..r..K..........V...@yF#b...>.[<;P..@*.....OINd(...T...C..T.w.s.b..$.....6+. ....R8E$..o..f."MD.@T"...fH..fX..O....AA..F*....+v.Q(KpXF..U"..x@...3|l..E..<.O..~..5M}.".q.#Y9....c.o.s...M.Cr..Dt.,..CtI.O..{D......H..*.+>*K..:.Y..-.l.v......'.....^.Y.k..E..c..~..S..P0.@.....<.!(.P.u.g.2....y..y..Z...v.^..lu.dC.a..o....{.o....h3A.K.I..-.O,..}.c>....Q1]....($..........s..b.X..........CJ.+..4.gE4T.S.*{g......(^...bA,...~..R..p...<G."..y.G...k..*'...i.u....I..S....\.......e$..m.2...{K........V......{me.%.}...P3...{.T..i..Av...K..g.... ...R..n..{m....t@Z....1A.H.2...^..R5)..4}..(...T......=...Pg...Y....y..e.$...]U..0.....8..Fs.(..O.....&..f,g..5..1.yo9..:cy...e..A.......i...i...G..4`)..#j.<+..{ai..[..[~.(,......X......3.f.m+3...B......_D.F.X.i.Y#.X......}_.d..`.i..i......T...7v..A.......?..c..~..g..w.D.H)%..B.!.......:.....ZE{........m.FN.....k...0.X...

                                                                                                                                                                                                                                Chrome Cache Entry: 860

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (4850)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):101812
                                                                                                                                                                                                                                Entropy (8bit):5.456445685313362
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:nTZPXcX3Z5iHe5yZJGRsJHrVKDnPYCrkuWZ24j:nTlXS3Z5SekZcsJHrVKDb4uWZ24j
                                                                                                                                                                                                                                MD5:AE18CD1F4E04C4C94B2C1490FC9C190C
                                                                                                                                                                                                                                SHA1:ACB5D07EC9E3033067B7EF452DD7546F350240F0
                                                                                                                                                                                                                                SHA-256:5329EB856287B8BEE65911EB4E1FE193BF2A6A91354D4326917D3AC9A680386E
                                                                                                                                                                                                                                SHA-512:33DF4B968667BC063BBF60A2C85947D33893750ED6A2F3975CE0203886D61F251C273ADE025BDFCFCB395B0CDAF693A7A11588EA1BEA2A6E7E11D03782374C75
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3icUr4/yA/l/en_US/rcl0D4zaUuw.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("TahoeTypedLogger",["Banzai","GeneratedLoggerUtils"],(function(a,b,c,d,e,f){"use strict";a=function(){function a(){this.$1={}}var c=a.prototype;c.log=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,b("Banzai").BASIC,a)};c.logVital=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,b("Banzai").VITAL,a)};c.logImmediately=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,{signal:!0},a)};c.clear=function(){this.$1={};return this};c.getData=function(){return babelHelpers["extends"]({},this.$1)};c.updateData=function(a){this.$1=babelHelpers["extends"]({},this.$1,a);return this};c.setChainDepth=function(a){this.$1.chain_depth=a;return this};c.setChainingContextIdentifier=function(a){this.$1.chaining_context_identifier=a;return this};c.setEvent=function(a){this.$1.event=a;return this};c.setIsAutoplaying=function(a){this.$1.is_autoplaying=a;return this};c.setMediaID=function(a){this.$1.media

                                                                                                                                                                                                                                Chrome Cache Entry: 863

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):6167
                                                                                                                                                                                                                                Entropy (8bit):4.4514990753759855
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:3ZCiNo0UQX1uXwGtjvjvDd3ti/F/0nP7/vEcKhirGGb7m/8sDM4UF9YX:Ai6nQX1uXZjvjLzGF8Pzv4E71EM4UP6
                                                                                                                                                                                                                                MD5:81DFE7BB0CBBBC7468DDE13D3F649273
                                                                                                                                                                                                                                SHA1:457BDF6F22B4C51255FBB5F198CA610B1037A932
                                                                                                                                                                                                                                SHA-256:3B1F3E116BB9E9FBDD0D1643D703CAA562E235EBC0B814214A83C23B8CC271D6
                                                                                                                                                                                                                                SHA-512:5BC6D25943EAE352363ED0123B9B178790AE2834A25178DA68603DC60E98FA531EA5148A2D93403A09829E0B387BC7E80A53CF8151CCB372A1386A1857F5F118
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/open.mp3:2f7070b0cd7bd2:0
                                                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom.......gmoov...lmvhd.............D..8.................................................@...................................trak...\tkhd....................8.................................................@...............mdia... mdhd.............D..8.U......"hdlr........soun.................?minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................Lstsz...................................i...................z...w...m...M....stco................udta....meta......."hdlr........mdirappl.............rilst...!.nam....data........speak_now....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000151 0000000000002E6F 00000000 00000000 00000000 0000

                                                                                                                                                                                                                                Chrome Cache Entry: 864

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 189 x 181, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):7289
                                                                                                                                                                                                                                Entropy (8bit):7.85997289674361
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:lCRDz8VAQEISzCSFRqJwUaAJN7VK97XN+3xii36e:lUq4IeJUN5K97NgN36e
                                                                                                                                                                                                                                MD5:E8D1B4455B9ED73DABB444AF813E0FD7
                                                                                                                                                                                                                                SHA1:FD99452B6FAD2E0D3C39FF17787A1849D3BB3CB7
                                                                                                                                                                                                                                SHA-256:B6D482EC59580B5BF80DAEC00E55656212867ACB26F09A0BB6173AFA3C45C4DC
                                                                                                                                                                                                                                SHA-512:4B7F5E5F9AC922A3EA337E3C50A2487BE41189AE92D3CA299E702815A7882116F07B8E9EAAB812C4A9986EA0186264A6613D531189438FF105458188FB323A9F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/WfXPMghq_2a.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR.............=Z.o....PLTEGpL...........................................................................................................................................................................................................................................................................................x..........5@T................................................(((.............................................................v.............................w..........................w......................................x............................... ...v..w...................................................................................w..w..w..w...........v.................x..x..w..............w..w..y..v.................w..v..w..v..w.....w..w..w..w........w............./..q....tRNS........>..........H.8Z......f...0.d..p$.P...~..v..*M....^.,.TF&6.....kB~a.\:.......xrz..,.?"....<.J..5......@. .mW..~..........J..2.P.z.4s....@1......Xa(...hF.R...e.

                                                                                                                                                                                                                                Chrome Cache Entry: 865

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):341
                                                                                                                                                                                                                                Entropy (8bit):4.845385553639442
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohgqWHiA4vmI4lAwuQgQIVY6Wqx5Xt6M0TRcmQTIfyuETUrNmraXnPt:t4noOAvmRHnIq6JmM0T7QobETUrsOpk8
                                                                                                                                                                                                                                MD5:A83C2EDA381FB2C86BE7587C8D53C330
                                                                                                                                                                                                                                SHA1:ECA052D4491403B1731D2FA36176CDAA4DD76F11
                                                                                                                                                                                                                                SHA-256:B011A7CD5658F11324619697CE2EA15178B057622074AE6CB687A0E95D978EC2
                                                                                                                                                                                                                                SHA-512:03C807382DC1320EFE94B3B47F30988F9153DDB655245139ECF40D90C97760FBCCFB117933736137BA4280D8964896B0ABBB64278BDA324A75BA7CD27557FDBE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/fashion/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 866

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (10220)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):79024
                                                                                                                                                                                                                                Entropy (8bit):5.386746440487104
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:drOMDK8NF0ntMD636tHdHaOMjKwSo3XItkuSbFdXys:drOqF0qMj3
                                                                                                                                                                                                                                MD5:02D6B41CCBAACFD4261E4F0C41358E29
                                                                                                                                                                                                                                SHA1:41C6C881667B92DBAA024D779DB2E8D97A034404
                                                                                                                                                                                                                                SHA-256:A0CE7C1BED51590A4EFE5193B272DE5A8493C0EEFF6B4F6B091A4AB96760F649
                                                                                                                                                                                                                                SHA-512:D94B3DF46CFCECB5CA63D9CCD70FD1E6A5A12ABC83F601FC99A4110169E0A411C6D08AAA95E69D4E846680F823A00E2D84A98BB2840ED8A3F139E6907C964276
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3idBq4/y2/l/en_US/InsJX4kWE-M.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="26010742205205782"}),null);.__d("GroupsCometAnswerAgentEducationModalQuery$Parameters",["GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation"),metadata:{},name:"GroupsCometAnswerAgentEducationModalQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("coerceRelayImage_image.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:{mask:!1},name:"coerceRelayImage_image",selections:[{alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"scale",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"width",st

                                                                                                                                                                                                                                Chrome Cache Entry: 867

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):274
                                                                                                                                                                                                                                Entropy (8bit):5.064374319451513
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4LyS7NHTZORTIhRJUTT6kg2AfI1NIfdAf7:t47N9U/vmRLy2NHTsYffLV6
                                                                                                                                                                                                                                MD5:A2ACF270DAF56F6484C50C1F74C5B676
                                                                                                                                                                                                                                SHA1:BD3B6DB51B936C0D49E293CB482CC2839A0D7D94
                                                                                                                                                                                                                                SHA-256:DB8400A38C08118E2FD10E60F84A2B4DE09A64721A665E23C37E03F092F41F94
                                                                                                                                                                                                                                SHA-512:6C94E190FA493AF676930E76713C5511FAD174C62506C7988072044C217ACC83847E8BCB4CC873A8B2B29D7B9FCB90CFE48336FB2450CFD7AE34C4F9C02A6CD8
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/news/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M11 11v6H7v-6h4m1-1H6v8h6v-8zM3 3.03V21h14l4-4V3.03M20 4v11.99l-.01.01H16v3.99l-.01.01H4V4h16zm-2 4H6V6h12v2zm0 7h-5v-2h5v2zm0-3h-5v-2h5v2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 868

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):172
                                                                                                                                                                                                                                Entropy (8bit):6.1888101623087435
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:yionv//thPl9vt3lY1zTu7ei2lJ3IM/Qskyrzjds8W8dW5vNmH2Y732QoOrZ3D5Y:6v/lhPezi2Xx/QI/jd0p5v8H/7311rZu
                                                                                                                                                                                                                                MD5:94B3D54162F3B71D7E8F4F719020025C
                                                                                                                                                                                                                                SHA1:FB9C707DCD66F1BA05B738638D622767C0997F60
                                                                                                                                                                                                                                SHA-256:22E8BADEEF599FF6C09F19DD7E354108600C40D094AFB8508562F0839C79DB63
                                                                                                                                                                                                                                SHA-512:0AD31B5687A84F382C22B82427317078B54FE2D29DD5D0183933FBBBAEEF2D63F2D3D37021D8A7278E11C000B8553E3DB9224A45A7C52268E5C4B836A8A3F45B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/web/monochrome/logo_16x16.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR................a...sIDATx..A.. ........&a.... ..H@...>...\.W.....H@.....MZP.......>.6..._..@...E.`......K.{.bx.=.... J..Tg.D...~.|..\......IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 869

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1527)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):14991
                                                                                                                                                                                                                                Entropy (8bit):5.444433315291858
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ZlS0EjmIMEsYGWLoJo2QFKfnuRBwgm8g0S94dMJ9jH5f/GfAg8NI:U7XxLWzQFK/mWg7g0XE3g
                                                                                                                                                                                                                                MD5:FDC9B5A35CD74FFF3EA372B1A0027A72
                                                                                                                                                                                                                                SHA1:F1E0E8E7924716986E31BF52B3FCA9FB0B781638
                                                                                                                                                                                                                                SHA-256:987EB7DEB2211F6BCB391972114E1C5EE71799B5086F53F1125883F18DCF6CBF
                                                                                                                                                                                                                                SHA-512:F19535F91DE11CAB1AE3D6ACED695A372F23D96941A58BE0CB68F64C8AE901928158BCFC812F21A1F3D7E3CA1FE8892E24A4AD3F4F1A5AFABA6A0555B145E7CE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/network.vflset/network.js
                                                                                                                                                                                                                                Preview:(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof n&&n];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var p=ba(this);function r(a,b){if(b)a:{var c=p;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&l(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,h){this.g=f;l(this,"description",{configurable:!0,writable:!0,value:h})}if(a)return a;c.prototype.toS

                                                                                                                                                                                                                                Chrome Cache Entry: 870

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2134
                                                                                                                                                                                                                                Entropy (8bit):5.507213070755754
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:8OLNKWMOLNKNFFZLOLNKE3JOLNK33OLNK4RVc+u1OLNKPN0oD:8OLNKWMOLNKXFZLOLNKE3JOLNKHOLNKt
                                                                                                                                                                                                                                MD5:81EEF3A68E6EA5131932245EDB5E75E2
                                                                                                                                                                                                                                SHA1:06A1E2FE3FEC268FD69122D8B2DA67ABA8EBBF56
                                                                                                                                                                                                                                SHA-256:F195EADE4059E1446EEEB8C16C8FDB17A540C2243AE3A37B63D55C4D93971382
                                                                                                                                                                                                                                SHA-512:261D5619A6FD2DAA3D125664F0F0B8CA85F6648AA544C3F04ED6489F29B1C8E70106525C3F498826D60F41C83E68C6968B5A51312D31E6CF39EB4EA03E4752A2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.googleapis.com/css?family=Roboto+Mono:400
                                                                                                                                                                                                                                Preview:/* cyrillic-ext */.@font-face {. font-family: 'Roboto Mono';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotomono/v23/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_SeW4Ep0.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto Mono';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotomono/v23/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_QOW4Ep0.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek */.@font-face {. font-family: 'Roboto Mono';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotomono/v23/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_R-W4Ep0.woff2) format('woff2');. unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;.}./* vietnamese */.@font-face {. font-family: 'Roboto Mono';. f

                                                                                                                                                                                                                                Chrome Cache Entry: 871

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (574)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3448
                                                                                                                                                                                                                                Entropy (8bit):5.484698692620344
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:o4Mjf+vi2hHGMmBUJFXtDaD6U81+K/tmbwTnw:0jf4fJLMhkdlah
                                                                                                                                                                                                                                MD5:C01A82AB927B56E6B5FA01F6CB78D8F7
                                                                                                                                                                                                                                SHA1:7C612A2A522DDD882C1DE037C38CFD0D05F6272D
                                                                                                                                                                                                                                SHA-256:11DB1E8D29DE3DA2678D53580C87CF5B9874BF842B7919861DE31FB1ECCA18E5
                                                                                                                                                                                                                                SHA-512:BE4366035AC2A2764A4557D4011EEBB5A339FA7C2214322F0293D516ACAD2E12CA4E9B6752B0CCE7D1581A17362835AA811EE7D8261D38204383736E1C9C49BB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,iAskyc,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,wg1P6b,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,ziXSP,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=Wt6vjf,hhhU8,FCpbqb,WhJNk"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("Wt6vjf");.var lsa=function(){var a=_.Pd();return _.Hi(a,1)};var qq=function(a){this.Ga=_.t(a,0,qq.messageId)};_.B(qq,_.v);qq.prototype.Ja=function(){return _.gi(this,1)};qq.prototype.Wa=function(a){return _.Pi(this,1,a)};qq.messageId="f.bo";var rq=function(){_.Lk.call(this)};_.B(rq,_.Lk);rq.prototype.Tc=function(){this.yO=!1;msa(this);_.Lk.prototype.Tc.call(this)};rq.prototype.aa=function(){nsa(this);if(this.Ez)return osa(this),!1;if(!this.EQ)return sq(this),!0;this.dispatchEvent("p");if(!this.aK)return sq(this),!0;this.NH?(this.dispatchEvent("r"),sq(this)):osa(this);return!1};.var psa=function(a){var b=new _.En(a.I_);null!=a.kL&&b.aa("authuser",a.kL);return b},osa=function(a){a.Ez=!0;var b=psa(a),c="rt=r&f_uid="+_.Rg(a.aK);_.jl(b,(0,_.sf)(a.ea,a),"POST",c)};.rq.prototype.ea=function(a){a=a.target;nsa(this);if(_.ml(a)){this.JF=0;if(this.NH)this.Ez=!1,this.dispatchEvent("

                                                                                                                                                                                                                                Chrome Cache Entry: 872

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (4199)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):19218
                                                                                                                                                                                                                                Entropy (8bit):5.386483333795039
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:audfEIMCVf6W/vtvayL5sDU/SkZKjAUpSiLw9UpYCjIgk9uzBi:ffL6W/vtvawsY/8suSr9UpYCjIgk9uFi
                                                                                                                                                                                                                                MD5:C8734A39BAC01098267A643B9D728D22
                                                                                                                                                                                                                                SHA1:33964CFF7039C268CA4432FC3F69A2B096D09D7A
                                                                                                                                                                                                                                SHA-256:505708C0E484FFF76A2CE4C98F2923DF33AB6D1F6DBCBFAB2AA083F46D78C7B6
                                                                                                                                                                                                                                SHA-512:18EC4598C30BFA490DBCAE1B73D2E451CD7853458CDD0B7E0473B91F0FA5F6E8E02FA2C504F2D99B4221C0D80170005FDFA3CA3EBFA4DC38EABDC68FDB543DCD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Ou=function(a){this.Ga=_.t(a)};_.B(_.Ou,_.v);_.Pu=function(a,b){return _.gd(a,3,b,_.sc)};_.Ou.Fb=[1,2,3,4];.var ABa=_.da.URL,BBa,CBa,EBa,DBa;try{new ABa("http://example.com"),BBa=!0}catch(a){BBa=!1}CBa=BBa;.EBa=function(a){var b=_.hh("A");try{_.Zd(b,_.Td(a));var c=b.protocol}catch(e){throw Error("cc`"+a);}if(""===c||":"===c||":"!=c[c.length-1])throw Error("cc`"+a);if(!DBa.has(c))throw Error("cc`"+a);if(!b.hostname)throw Error("cc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};DBa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host=.b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.FBa=function(a){if(CBa){try{var b=new ABa(a)}catch(d){throw Error("cc`"+a);}var c=DBa.get(b

                                                                                                                                                                                                                                Chrome Cache Entry: 873

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):218409
                                                                                                                                                                                                                                Entropy (8bit):5.457584780104673
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:Vmgr4xMzGg6HZWP0A7kNA5mz6iE80+7x6oSdw4nhPaJRCdae4pl:sgM6qgHP17oV7xBCAeKl
                                                                                                                                                                                                                                MD5:02576C95C19ACB48ADAF9305DCB72B80
                                                                                                                                                                                                                                SHA1:D3063E2F83F50ACB75B56C9395863D1A8F956749
                                                                                                                                                                                                                                SHA-256:E2599B9FA985E9D76D458B4F71B451956B86F7858BFC15DBD233902201C1F1A9
                                                                                                                                                                                                                                SHA-512:A5E31DBCAD5F186A451856C0A3215D6F7D69DE783E7B899CE3572062B15664110D9ADCAB085126BE6BA71B164961FBC5BC28879DCB024A173715FD3296F3183B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.J6zlSvuPGsg.es5.O/am=P2CJhmMBEISZlnP-nnFyGAAAAAAAAAAArAHs/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFDOtZOCEsISxnbv91FcSS8ccV5Hw/m=_b,_tp"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x689603f, 0x1040058e, 0x27396998, 0x1c9c67bf, 0x18, 0x0, 0x1ac000, 0x3b, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Ra,haa,Za,bb,cb,db,eb,iaa,fb,lb,jaa,kaa,pb,naa,paa,Eb,qaa,taa,vaa,Pb,Sb,zaa,Zb,Daa,Haa,Iaa,mc,Jaa,Maa,Naa,Paa,Qaa,Raa,Saa,Wc,Vaa,Uaa,Waa,dd,bd,Xaa,ed,Zaa,hd,nd,$aa,aba,xd,wd,gd,Sd,hba,jba,kba,lba,nba,oba,Od,qe,re,Ae,Eba,Ne,Gba,Oe,Hba,Jba,Lba,Pba,Qba,Rba,Sba,Vba,Xba,aca,bca,fca,pca,lca,rca,tca,uca,vca,yca,Aca,Dca,Eca,Fca,Gca,Hca,Kca,Nf,Lca,Mca,Oca,Sca,Tca,aaa,Uca,ag,Vca,cg,Wca,Xca,fg,Zca,hg,fda,jda,ida,qg,lda;_.aa=function(a){retur

                                                                                                                                                                                                                                Chrome Cache Entry: 879

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):221
                                                                                                                                                                                                                                Entropy (8bit):5.051880229825864
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4Bo0NiGcrlSnfa9I7LKY:t47N9U/vmRBo0crlsfaq7n
                                                                                                                                                                                                                                MD5:83D9AAA5E179D445E561E8167CEB4D7A
                                                                                                                                                                                                                                SHA1:CBD241357B025084C9B107CC5ED0803B0A776C3B
                                                                                                                                                                                                                                SHA-256:AA910C07266E14040CA7215E0070769E61A15B724868E1060AE081E8160AB25D
                                                                                                                                                                                                                                SHA-512:9071196C5F5CB17BEE54A65712CE1CA63BFDE00EB7892B9056028854C010C57F4BFE59526512266BD11910D65D834425CAEB08529479F96CB52BC49ABC94A48E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/home/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m12 4.44 7 6.09V20h-4v-6H9v6H5v-9.47l7-6.09m0-1.32-8 6.96V21h6v-6h4v6h6V10.08l-8-6.96z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 880

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):251
                                                                                                                                                                                                                                Entropy (8bit):4.807326238374636
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4hLBIl/qVs+RLjUjUX:t47N9U/vmRYiVswfUjUX
                                                                                                                                                                                                                                MD5:05A720716D71F9F56D6C0E5C4B47680A
                                                                                                                                                                                                                                SHA1:D24611C11E8CC3B158EB518F2298D1E35CE03E48
                                                                                                                                                                                                                                SHA-256:B90706D55C1E8B616BF8D677C195D09AF8AA75BC669BA3A36A25480CA86F6926
                                                                                                                                                                                                                                SHA-512:D0DA0CCC993DB255F96AC9CCDDA35DAADA2928F17A1262F5954B6A3C54B57080544E5A9C3808275749ED15A118AAA9B44B50B0AD8A1F2BE668F9D7614A0456B1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/x_mark/v4/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m12.71 12 8.15 8.15-.71.71L12 12.71l-8.15 8.15-.71-.71L11.29 12 3.15 3.85l.71-.71L12 11.29l8.15-8.15.71.71L12.71 12z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 881

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):367
                                                                                                                                                                                                                                Entropy (8bit):4.678729266974906
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4uZBPeRPbmcsstyLTngAV99WTc6XzQuJ3/vh7QrS3/IUp+wb:t4noU/vmRyPeR9YngQ9Ec6jhJ3XBAUp5
                                                                                                                                                                                                                                MD5:A28E7BAA1C8C78EFFBDB2D0AB01D9EF3
                                                                                                                                                                                                                                SHA1:F3408C777CFED5C38AF966596750F675637B012E
                                                                                                                                                                                                                                SHA-256:7A7A47330CB72F09686EDF979205FA844FA134556F81F046EFECF07B1401A557
                                                                                                                                                                                                                                SHA-512:14AE281980FA9715DFFF5BB4F22EE6B4959F3C15355B71AA65E43392E598F40DFFDDFBC0670D02D29A7C7A238B0066064174385439D0291275FAEDCE26808146
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/bag/v4/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7 8c0 2.76 2.24 5 5 5s5-2.24 5-5h-1c0 2.21-1.79 4-4 4s-4-1.79-4-4H7zm9.9-2c-.46-2.28-2.48-4-4.9-4S7.56 3.72 7.1 6H4v14c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V6h-3.1zM12 3c1.86 0 3.43 1.27 3.87 3H8.13c.44-1.73 2.01-3 3.87-3zm7 17c0 .55-.45 1-1 1H6c-.55 0-1-.45-1-1V7h14v13z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 882

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):251
                                                                                                                                                                                                                                Entropy (8bit):5.1580903557505975
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohgqWHiA4vmI4hi6Dd7kC0qmjWpYp:t4noOAvmRnJ7l0pWpYp
                                                                                                                                                                                                                                MD5:931DADAA2F58D46D80735C58183888D0
                                                                                                                                                                                                                                SHA1:FDB576A133B05B9E28D71E7901B1971CB0335A7C
                                                                                                                                                                                                                                SHA-256:D59C1758BAFD761AC0CFAE8C33F29DD4F1229F6369E4C36FB3DF9C2DAC2E394F
                                                                                                                                                                                                                                SHA-512:D4C09F78A450717FEF762941DD897AD5CB3BBE23308E9092DC23E872285F3A17E74FDCCE4492E1ADFAEA0DB2C57229A7469F02816DF5D10092CCFEF26B5F6728
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/video_camera_add/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M14 13h-3v3H9v-3H6v-2h3V8h2v3h3v2zm3-7H3v12h14v-6.39l4 1.83V8.56l-4 1.83V6m1-1v3.83L22 7v8l-4-1.83V19H2V5h16z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 883

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):442
                                                                                                                                                                                                                                Entropy (8bit):4.813019877520226
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4noOAvmnqtXy+R/Ro1ImoXHNR50buAD2NfnRimbf:t4o7vNC+R/cImoXHN1Nf
                                                                                                                                                                                                                                MD5:8508DD8336C60695AFCF1158C2EF0EF2
                                                                                                                                                                                                                                SHA1:32CC87A7AE016449C6038284CEDDBA3E3D0B1791
                                                                                                                                                                                                                                SHA-256:DEBC90222AA11F028051B9E116A7AD054ED560854FB326A5C38254DA354CFDEF
                                                                                                                                                                                                                                SHA-512:35DE791E5CE1F47AD1FF89A594DB6FE055920481ED73001EAB97C12A7DC31077A6C5B64740FBFC682923BD98149F4A67AD0C027532EA1BF7EAA3C4D45579E930
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/arrow_time/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><g><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM22 12c0 5.51-4.49 10-10 10S2 17.51 2 12h1c0 4.96 4.04 9 9 9s9-4.04 9-9-4.04-9-9-9C8.81 3 5.92 4.64 4.28 7.38c-.11.18-.22.37-.31.56L3.94 8H8v1H1.96V3h1v4.74c.04-.09.07-.17.11-.25.11-.22.23-.42.35-.63C5.22 3.86 8.51 2 12 2c5.51 0 10 4.49 10 10z"/></g></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 884

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):153
                                                                                                                                                                                                                                Entropy (8bit):5.109321191076272
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb58FpErFuH4VNX1X3MHqllPrErcHG8ih5SbBdTdUREygEPBiv:tI9mc4sl5RISmK3DEqFhFRWUEJM
                                                                                                                                                                                                                                MD5:24A230CF90D6B94FB985450DF0FE5B42
                                                                                                                                                                                                                                SHA1:2E85AABAF518A88729C540D7B71C1F25DB3A54B4
                                                                                                                                                                                                                                SHA-256:138C2676B4C6DFF51D3D5B6AD11459AEDEA9BD19E34B99B652C454636E377735
                                                                                                                                                                                                                                SHA-512:A4232A5278AA188D9614C7282400C85317DBCA7CAA685BC1FBAEED8B9B8223EBB3E78D4112A6DD783CA2C6D62BE4831779CF7ED5346A3E1DBB1191810A776845
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_download/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path d="M0 0h24v24H0z" fill="none"></path><path d="M19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z"></path>.</svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 885

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1631)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):38674
                                                                                                                                                                                                                                Entropy (8bit):5.373344735979869
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:AOZQqlnxITA3+sypwDMBub/6rur81gE0idWSBiHLztbyHgNkmtCgs+FwtNmle:efY+3g/br8qaWSBiHLRGHEbtCgKJ
                                                                                                                                                                                                                                MD5:9FB0BDB3A292F495914A785280685816
                                                                                                                                                                                                                                SHA1:2FBAC1566F42B41D336C3CEF46085A8ABA5291F4
                                                                                                                                                                                                                                SHA-256:8B94EC92B902A78BB5DCF8A9A5CF00B3F693738608FE110FF77A2E90FA62AA09
                                                                                                                                                                                                                                SHA-512:94E76518978E828E0EAA8B95C807E55DBF4E0EBA201FF5057906482AD5F57D2D2A6BA98F0EE16476688E3B5013525D06EAED692C6B795DAAE635F67B8CD100F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.moa=function(a){var b=0,c;for(c in a)b++;return b};_.noa=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ka(a)||"string"===typeof a?a.length:_.moa(a)};_.vn=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map||"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ka(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.yb(a)};._.ooa=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg||"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ka(a)||"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.zb(a)}}};.var poa,soa,roa,qoa,Ln,Nn,Eoa,voa,xoa,woa,Aoa,yoa;poa=function(a,b,c){if(b)re

                                                                                                                                                                                                                                Chrome Cache Entry: 886

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (516)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):9642
                                                                                                                                                                                                                                Entropy (8bit):5.435855411923511
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:flejPRjM65ile/Q0Y5CaNLMASVZkXK7aACjbN9LDXxdZ7G92tXL74dESC:1oURjwgXK7aAq9LDXxdZ7G0tXL74dESC
                                                                                                                                                                                                                                MD5:DAC3D45D4CE59D457459A8DBFCD30232
                                                                                                                                                                                                                                SHA1:946DD6B08EB3CF2D063410F9EF2636D648DDB747
                                                                                                                                                                                                                                SHA-256:58AE013B8E95B7667124263F632B49A10ACF7DA2889547F2D9E4B279708A29F0
                                                                                                                                                                                                                                SHA-512:4F190CE27669725DAC9CF944EAFED150E16B5F9C1E16A0BBF715DE67B9B5A44369C4835DA36E37B2786AAF38103FDC1F7DE3F60D0DC50163F2528D514EBE2243
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/scheduler.vflset/scheduler.js
                                                                                                                                                                                                                                Preview:(function(){'use strict';var g;function h(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var k="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var l=aa(this);function m(a,b){if(b)a:{var c=l;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&k(c,a,{configurable:!0,writable:!0,value:b})}}.m("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}.function c(f,y){this.g=f;k(this,"description",{configurable:!0,writable:!0,value:y}

                                                                                                                                                                                                                                Chrome Cache Entry: 887

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):11824
                                                                                                                                                                                                                                Entropy (8bit):4.306765430849705
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:F26SMbW4XFKQfjJ1yXczqPm55zYc3OQQiWp4L7w3DeMFWJov6dHmhr:F26SXyjfjusW+vYcUiWS+eMFWWvAur
                                                                                                                                                                                                                                MD5:FDC41C1E6C6AE5E5580F16DDBF54B8FF
                                                                                                                                                                                                                                SHA1:22AC53E9CD9C5B62127E26A67F00F0C20C656785
                                                                                                                                                                                                                                SHA-256:50F120F926C1520EC05A1C63CAB4B2C00FD7B1E8F94A3ECA839D7973A144F88B
                                                                                                                                                                                                                                SHA-512:885271FBD1B79E33B2FC91C2AF6A1285C42E08EC2276C942F784165B1389E66D5D56A66DBF99787234773B80370FA4F38F7085CADBF381C16FA54CC15E042BF4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/offline_no_content/v1/192px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 195" xmlns:xlink="http://www.w3.org/1999/xlink">. <defs>. <path id="a" d="M0 194.555V.675h191.961v193.88z"></path>. <path d="M.668 18.586C8.545 12.047 15.125 3.19 25.082.49v20.673H.668v-2.577z" id="c"></path>. </defs>. <g fill="none" fill-rule="evenodd">. <path d="M63.227 57.833s-4.403 1.068-5.938 1.483c-1.456.393-4.553 1.79-4.443 6.532.112 4.74.112 4.463.223 5.85.11 1.389 1.11 3.444 3.053 3.999 1.944.555 2.834 1.777 2.444 6.386-.389 4.609 17.055-6.552 17.055-6.552l-5.41-15.82-6.984-1.878z" fill="#DDD"></path>. <g transform="translate(0 -.341)">. <mask id="b" fill="#fff">. <use xlink:href="#a"></use>. </mask>. <path d="M96.24.675c-17.36 0-24.86 17.956-38.835 24.25-9.382 4.226-31.732.669-39.879 14.75C9.38 53.757 20.86 65.52 15.12 74.544 9.38 83.568-.48 85.263.02 99.774c.5 14.51 20.374 19.494 22.32 30.4 1.946 10.908-4.853 13.059 0 28.997s18.193 17.626 35.867 18.065c17.673.439 14.368 12.34 32.52

                                                                                                                                                                                                                                Chrome Cache Entry: 888

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (663)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3238
                                                                                                                                                                                                                                Entropy (8bit):5.387809520815037
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:o7BOsUSmiHXpkgcKmdNQ8jsetptY2PfygpcaNQJpSN9KI9hGKb1iqyBKAErw:oE07udO2F5caNQJwN9KAuezw
                                                                                                                                                                                                                                MD5:6B5509EDF491407D765B9248417B3F68
                                                                                                                                                                                                                                SHA1:5380993E0C0CFA67982B78BD17E283625EE0E77A
                                                                                                                                                                                                                                SHA-256:F9D2DB8058E0E3CCBEA9FEA1551EE4D9ECFDBD010E10A9922B9389CCD2F13F31
                                                                                                                                                                                                                                SHA-512:EE9962EA56BE934771649D7157CD7D86933EF07C3813D5C5C962E2D3F5DC53D9F6502D9B2BE24B389E7CB48BF458E8A7E5962BC1FCF283381507724FFCC60989
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var $v=function(a){_.I.call(this,a.Ha)};_.B($v,_.I);$v.Oa=_.I.Oa;$v.Ba=_.I.Ba;$v.prototype.YM=function(a){return _.se(this,{Xa:{eO:_.Hj}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.uh(function(e){window._wjdc=function(f){d(f);e(BDa(f,b,a))}}):BDa(c,b,a)})};var BDa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.eO.YM(c)};.$v.prototype.aa=function(a,b){var c=_.Xra(b).Xg;if(c.startsWith("$")){var d=_.em.get(a);_.Vp[b]&&(d||(d={},_.em.set(a,d)),d[c]=_.Vp[b],delete _.Vp[b],_.Wp--);if(d)if(a=d[c])b=_.re(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.Lq(_.jda,$v);._.l();._.k("SNUn3");._.ADa=new _.qk(_.vf);._.l();._.k("RMhBfe");.var CDa=function(a,b){a=_.rqa(a,b);return 0==a.length?null:a[0].tb},DDa=function(){return Object.values(_.So).reduce(function(a,b){return a+Object.keys(b).length},0)},EDa=function(){return Object.entries(_

                                                                                                                                                                                                                                Chrome Cache Entry: 889

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):8816
                                                                                                                                                                                                                                Entropy (8bit):5.436678491959421
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:ylNOClN1lNzlN33nlNLlNjAlNOkNfCkNRkN+kN23nkN6kN+AkNIPNKCPNBPNXPNH:yLOCL1LzLnnLLLsLOifCiRi+iEni6i5d
                                                                                                                                                                                                                                MD5:AE497D5B41E511A0C483D361F08C36A4
                                                                                                                                                                                                                                SHA1:0ECCD2799595112C5B8169CC3370A2F0E384C028
                                                                                                                                                                                                                                SHA-256:C05133DA71148E748CBFB62FBE60097B7FF257B76B0369CAFBB7F0C1C5C2F13B
                                                                                                                                                                                                                                SHA-512:7316310406CAC1A179E3DE13AFFBA49FBE9B0B1A217A71AB1B6D7AB6287909E80010D4221209E526D939309C0CD21D7DDE7A1FF4E84D4ED146EE005FA0F672D5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://fonts.googleapis.com/css?family=Roboto:300italic,400italic,500italic,700italic"
                                                                                                                                                                                                                                Preview:/* cyrillic-ext */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc3CsTKlA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc-CsTKlA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc2CsTKlA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Roboto';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOjCnqEu92Fr1Mu51TjASc5CsTKlA.woff2) format('woff2');.

                                                                                                                                                                                                                                Chrome Cache Entry: 890

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 21700, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):21700
                                                                                                                                                                                                                                Entropy (8bit):7.989666631701204
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:PxbG/ZciREUTWlMwbptJm5f9/1HuLZ4r38bxSpfGL/+SHA+ilQlO3fq8O/4s:5bfiBWlRPm5fjrruYJGTiqlO3fo/p
                                                                                                                                                                                                                                MD5:7D75A9EB3B38B5DD04B8A7CE4F1B87CC
                                                                                                                                                                                                                                SHA1:68F598C84936C9720C5FFD6685294F5C94000DFF
                                                                                                                                                                                                                                SHA-256:6C24799E77B963B00401713A1DBD9CBA3A00249B9363E2C194D01B13B8CDB3D7
                                                                                                                                                                                                                                SHA-512:CF0488C34A1AF36B1BB854DEA2DECFC8394F47831B1670CAB3EED8291B61188484CC8AB0A726A524ECDD20B71D291BCCCBC2CE999FD91662ACA63D2D22ED0D9F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
                                                                                                                                                                                                                                Preview:wOF2......T...........T_..........................4..*....`..~..d..u.....,..$.....6.$..|. ..V..K..^.=...sp.f.m../....l\.....T.9.n..A...........2x.{P[V..v%..M...f.7..+c.cM.'...$..u.H4[?i.'..T..+.(...L...inV.@.dd....T.. }b...c.ghRA..I$.su.....`....Q.OB..S.{.#.3..o.{v.........n...]f#b.J_.......}# ..1... F........=?O.|._p........X.6.VQ.*.E..rU...}....dK.$...0.W..2i..Y...9.Y.............f{..6'....C:%.(........}.....W..._....k...|.........Y8./..e..........L......_.9..v...2F..$..y)....UWu_..T.]qE.H.b..OP...B@.4.!,F..._............z.3.*.A,h.M.(...6~_[U$.....uM2.*..qz.v.........hV\|?.......M-.h..by.A,.}.....?...52.g.,....<..s..k....h.U.]1.1..O......m......j...}6.j.v.a..R....Fj...).fO3........GSM....... ...GL..({A....$O..&'..\....:.x....{N.p8..q..iF..k...b.>....<..M..`.....d.I.5... .x...mo.L.?A(..F }./.._V.e.A.Z3.....C...h...f......(,..3....%.h'.?sG..&x..W.......b].'34.S#s...wiG.O....J.ADDDDBw.m;.....K.ti).....?.6.\.M..d.....[.z....4..D.b...6..F.....F..D.r

                                                                                                                                                                                                                                Chrome Cache Entry: 891

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):50292
                                                                                                                                                                                                                                Entropy (8bit):7.995966046301038
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:1536:BChItbKr8Zq5itq5+xOIb69auwqhh0aRiMI:0h/r8ZyitRxziaOXTRY
                                                                                                                                                                                                                                MD5:7E5131CA3D7DA0BEF6CA6607CEE8EE19
                                                                                                                                                                                                                                SHA1:8BF30E19A9FD96E2358B7B969C658E58B5606CF4
                                                                                                                                                                                                                                SHA-256:E9CCC1E73D2BDB5CCA77D0471ABA87F5798D7AF3B870923BF3B1E93AFDB25405
                                                                                                                                                                                                                                SHA-512:10220940B7EF69310CAD7DF97812CCA26B5A51A1824F44DB201C64F56934CBAE52DBDE7B5EC72CAF76982845D0F4F0B6EB88A5A9D308D78633B4EACF182DD993
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/GHqwK-_osLs/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBJHn8_sNjU6M5z59nZ3B49-lGdnQ
                                                                                                                                                                                                                                Preview:RIFFl...WEBPVP8 `....b...*....>Q".E..%!&x{x...cnK.....'e..v/...1..c.G....z..1..b.....U.S:c..h=.yN......w..DO.........w.G..'.....?.?t>p.g.........=.{...0....G.s......d.V...........'.O._...~).j.7.c.7.............w..._..?.?...{\...p.....s..........s..?..............s.....?#}......_.....z.........o...O............~../...o............O.....~5...7.......A.1..........~..9o.............................~..s.O.......?.?...............x.}.........`?........S..............k...O............?...g.....'.............................W...o.eHoO.@...pK|h.....c...=..Z...I.C.5+q8....!.S.L0p.n8...tD.C..y..F.......zz!.`.,.Eu,9.......U.B..c}....b.:.....k....O9..M.zC.....n...:...Y. d....K..p....:.......5.....8.(._c.../c.f......}......"...a.$...........E.h.g.I.....$....9.......D..s.:y..)Q......].d.G<Fw.....>R..<..\._$,Us....r..gaM$......W...~q=f.G..Q.{BU...W...%p~q..:.y..Wf4....K}@........VGV>.M..a).R.....V../K.m..!....V.F"..^g.......:\.......;.-..5.95.'.3#.GAx.O...[...z.

                                                                                                                                                                                                                                Chrome Cache Entry: 892

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):372
                                                                                                                                                                                                                                Entropy (8bit):4.852483300837517
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohgqWHiA4vmI4lAwuQgQIVY6Wqx5Xt6M0TRcmQTIfyuETUrNmraXnPZ:t4noOAvmRHnIq6JmM0T7QobETUrsOpka
                                                                                                                                                                                                                                MD5:388308EEFFE6F910D8A30CA28F6A4306
                                                                                                                                                                                                                                SHA1:864144A8145338E37C1DEF12177A02EECBABA4A2
                                                                                                                                                                                                                                SHA-256:A78851FF5ED5AB0CB2DE879F608214C4C33BC41841F279B1F622835407AEA643
                                                                                                                                                                                                                                SHA-512:460C26A65AB98BAD2574A5A3405CBFEC71465544632887C388E982E84EBEC2E45F21D703767783199186C51A2998965EAB3A66F5ECD4753E26D6B257ECDAD0DD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/fashion/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M12.5 6.44v-.5C13.36 5.71 14 4.93 14 4c0-1.1-.9-2-2-2s-2 .9-2 2h1c0-.55.45-1 1-1s1 .45 1 1-.45 1-1 1h-.5v1.44L4 13h2v6h1v2h1v-2h2v3h1v-3h2v2h1v-2h1v-3h3v-3h2l-7.5-6.56zM6.66 12 12 7.33 17.34 12H6.66zM14 18H7v-5h7v5zm1-3v-2h2v2h-2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 893

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):651
                                                                                                                                                                                                                                Entropy (8bit):4.46155201399217
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmnqMViiuJJsUG0aLn+djONWQismTRIaZmU5SuX6RfM3FLvTkwWEarekr:t4jU/vns0aLn+djqWQismiaZ5SuKNMFo
                                                                                                                                                                                                                                MD5:C34B523D2E0170B739016B744ECD8132
                                                                                                                                                                                                                                SHA1:F7CA671F70271C053516306DF1820618C279E657
                                                                                                                                                                                                                                SHA-256:55C9BBA2243E3B97567B36A6F9C888A52805E5B6C391168C892D5D024BC01266
                                                                                                                                                                                                                                SHA-512:01AE29522C00F9761ECE2399306313A85BB5E65797011BAFFC40BBA54540B718F423F5707A67EB16B43B78EFFE1D40906B4E422D1AF7FCE8BBC0C32A8F9BAF46
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-2-2 .9-2 2-2 2 .9 2 2zM8.48 8.45l-.71-.7C6.68 8.83 6 10.34 6 12s.68 3.17 1.77 4.25l.71-.71C7.57 14.64 7 13.39 7 12s.57-2.64 1.48-3.55zm7.75-.7-.71.71c.91.9 1.48 2.15 1.48 3.54s-.57 2.64-1.48 3.55l.71.71C17.32 15.17 18 13.66 18 12s-.68-3.17-1.77-4.25zM5.65 5.63l-.7-.71C3.13 6.73 2 9.24 2 12s1.13 5.27 2.95 7.08l.71-.71C4.02 16.74 3 14.49 3 12s1.02-4.74 2.65-6.37zm13.4-.71-.71.71C19.98 7.26 21 9.51 21 12s-1.02 4.74-2.65 6.37l.71.71C20.87 17.27 22 14.76 22 12s-1.13-5.27-2.95-7.08z"/></g></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 894

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3123
                                                                                                                                                                                                                                Entropy (8bit):7.817640645893664
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:UxvEC/DBuKzU71pKFwGj6LrtzwE1xrSk/yEIsolOT9bsdqImOiX1FG3vcdPld:Qf9zgyRgrtJrSk/yEewOqXOiHZ1P
                                                                                                                                                                                                                                MD5:7EB6D32FA74ADA1C19EE90E0F07C1741
                                                                                                                                                                                                                                SHA1:815C364083E6E47175DC9CB1B2046C183C0B94BE
                                                                                                                                                                                                                                SHA-256:F841D0012142DE61903231FE60EA3628567EC4766B22DC41F5E8932EEE184699
                                                                                                                                                                                                                                SHA-512:6A6C44C1FFB21C3B16529A6E851ABFFF49F1D680CD4C99054A5BC9F4FFA512E3F2AC7237EEB4E9099D8C3C6EC919118A0971405C6AE3079F00D345371757AAC6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://yt3.ggpht.com/ytc/AIf8zZT70wxvwiE287W10Js-em8ph7--KyxFIifVkr8XaQ=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                                                                                Preview:......JFIF.............*Exif..II*.......1...............Google..............................................................................................................................................D.D.........................................6............................!..."#1..QaAq..24r...$BC........................................................?.;.+.m..........e.P.56...M.5Y.uE'.:....(.oR..2k.6.&k]{.L....cWI.`.....r.T....?a.l...l...[-.K...k.,.4...@.7V.^A......O...k....@...j..f...}.........~..7..{..^..r.i._.Z.&.Z.~.:.`.}.o1..UU..H.vu.X..`$.o..bsl...\.|.Wp..O.U_o.=.N.\.}......Ao.F:...^.%.F#..E.J...&........y.].......i..`.^...Z..........Y.(.UG.I@..z.w.n.l......0....s_..B.]f.8<)...c!.T>...9..Jc.j.i.8/.ke]E,..._..<..*z...oz..NT.b..!.f.B.r. |R. .ZMG.x/.Ao.U.......H ...1=....0.He...M.v.].e...R`..K....P.i2..m..........J..j..e}..F.U.V.P.B...!..&5.E%Tj..D....@.(@C.yi..f,>..PWe..t....N.r........?`a..?......7..7O}....}KZ..j..7.I....QRX`...*.. 1 .U....:..t.!.i6#...+

                                                                                                                                                                                                                                Chrome Cache Entry: 895

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (3367)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):30293
                                                                                                                                                                                                                                Entropy (8bit):5.535489582127669
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:Tsez1EDy+Pbe0dmjHyc+Rs23g/+FBT3KTOcI5zrSZ6r4R8:o5S0EjF1Car8
                                                                                                                                                                                                                                MD5:291AEC083026B4A69933345E4A8EC700
                                                                                                                                                                                                                                SHA1:B82293A123F627C42136E47E0FDDCACC9BD33FD4
                                                                                                                                                                                                                                SHA-256:BC761CE6529E5AC4321A1B78FC1F457EF74C692980CEF5642BD8A0B762031D07
                                                                                                                                                                                                                                SHA-512:0E24548F53D28F90046C2CA705649363DBB1E4BB3563EB05A1045E9AF904A1FFD939E531918B337A39C54EBF59A47BA26C5EBBDF670D4F88B86696100AA15A91
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iMz64/y-/l/en_US/cvkeasQlp8Ct426Vxq3HF6.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("FBReelsRootWithEntrypointQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7090801701039075"}),null);.__d("FBReelsRootWithEntrypointQuery$Parameters",["FBReelsRootWithEntrypointQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("FBReelsRootWithEntrypointQuery_facebookRelayOperation"),metadata:{},name:"FBReelsRootWithEntrypointQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometTahoeSidepaneDialog.react",["ix","CometCircleButton.react","TetraText.react","fbicon","react"],(function(a,b,c,d,e,f,g,h){"use strict";var i,j=i||d("react"),k=32;b=16;var l=k+2*b,m=16;function a(a){var b=a.bodyAspectRatio,e=a.children,f=a.onClose;a=a.title;b=b!=null?j.jsx("div",{className:"x78zum5 xl56j7k x6ikm8r x10wlt62",children:j.jsx("div",{style:{paddingTop:"min("+100/b+"%, 100vh - var(--header-height) - "+l+"px - "+m+"px)",position:"relative",width:"min(100%, (100vh - var(--header-h

                                                                                                                                                                                                                                Chrome Cache Entry: 896

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 512 x 512, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2646
                                                                                                                                                                                                                                Entropy (8bit):7.535890561470208
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:dS7tX31YrfuHYZqD2f3cCrH5hdN4ohX6RHHVBo0xRIbTt8UE30+s5vVfAcxRf8L3:AZFY7HZqK/NrHXdnhX6RnLAtLE307vNs
                                                                                                                                                                                                                                MD5:93C7ABB7732DF734CAC063C1A09F6135
                                                                                                                                                                                                                                SHA1:271617755AA0E94AB8DCBA8E7D3E8BD3A3249ABB
                                                                                                                                                                                                                                SHA-256:70660CD5E4B36800F22F179CFBC6B2E45C67EC9C7531571497170C614512CD28
                                                                                                                                                                                                                                SHA-512:AF8DFB1704068ED908894FBBDA962EE3FAC60EFEE7C4AE2E065E0DC8D0F9E24F5F9581629BD616E0620DAD7505EB2412F7B445A675383E147494E9EF6790C5D6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/web/monochrome/logo_512x512.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR..............$....HPLTE.........................................................................xx.....tRNS. 0@`o.......P.._...p.Oi.......IDATx......................................................K.{ua.0..A...+....0sb.i..g........e....!..<.)....T.W`.M.m.]L.K..@!.r.<.%$vW.XC.3......G=L.6.2.4wQr.Z....v...P7Q'1........s...a.s..q!.;...P.khc...N.P....%...%...c..-A.F....R...rZ......sz.`.........m}.......W.......|....GfA...,.....b~;]8..........2...g..w...ZA....n(l^....FQ.ZN.G.iI..l.#...T.................yG......0./....~3.3.M.x..0.H.`.x.....7.....x....lQ.X..G.....(..J.z8C).F9`.$....(......s...w...._..e.w.......n./.h./......p......]...`=.x.p.......)....p.1..8.1...x...E.,a.,.E ..)...b.OH.H.H...0........a.@..,...+....y...{..&..d...@...aHX.g..{..0x..0y..0{..p...`....n^.B.....*.:.*.:.*.:.}0.@......;.@.9.6.7#WA.L....9...F...O........t.`.} s.} o..A....#...F.7s..EN.5$..[...5...\.......`.Z....A+...m..$....5).u.u.I....%.].5.{.....$.B.....D..^.QU.R..9..:!.d.

                                                                                                                                                                                                                                Chrome Cache Entry: 897

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 32140, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):32140
                                                                                                                                                                                                                                Entropy (8bit):7.9941922772245
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:768:sWzfeCBJsfRau5EAgzQRLYxSjbminAOvb5oAqLR43U8u:sW6CB8RXraSj5nBqAqLgUR
                                                                                                                                                                                                                                MD5:81AC05C6D01D84D913A56C11909CDC7D
                                                                                                                                                                                                                                SHA1:55F6BD5429C5A35ED53CAAE2CD50D856EDCB7883
                                                                                                                                                                                                                                SHA-256:B222B23C6EE94816389506D4DE8EAD66181C8053242E1E1EB784CCAC46BC7EE5
                                                                                                                                                                                                                                SHA-512:0925243828F33130CB3B68A6A113F1AABD07A8B19B3B99F45E5A2B1B2473622FA997D833C1D4B7B71781F246154D3A145AEA37CDA5351DC851EB3F4E550677AE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/youtubesans/v23/Qw38ZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HO_T7fE.woff2
                                                                                                                                                                                                                                Preview:wOF2......}.......=(..}...........................'...\...?HVAR.n.`?STAT..'*..,/\.....x.1..J.0..(.6.$.... ..&..d..[<+q..w.i...?..9f....w.s_R0......1.s...s...1.O...f.n......Xe.R.IJ.Y$e$QT....~d....Z...s.FKY].niUV.o..[...g.0.oX.....^..AQt.a..oI.yb....].s..?.{..-dZ.TyW..{..3.H.H._H".a.+....~=G....=l....~S...[s.o.U....bc.r.....{.{.A....3..". X.".......WV....E,.........*.b4Fc...o.g/\...(....|.|2.Q....Z...Vw.u.......#.....i..1......[...R....,!..B.%k4......p(...W~....*@].x.............k.$.LF=<n.?.Q....~1.M.......+..AB..D..b$...I..q...3.m.Y...v..0.=.....f....I!E~.%...S.].AY...........[..a.~.....&.!]..Y..,...\k.........L..q.n.3.Tf.}...PQ..B.z9.'.......p._7K..Dt.j.8.....}.._..+.....V3..At.=?D.^...$...@..q..q.GA..Z....P%.&[.+.4.#..:.K.-...dG.: L.^....Y.E.e.....L..G.jg.gf.Jv....^.....bs..).?#).G`........U._..h....AZ..6)Ga..p%.B_.... *.r.:.......eR.....eJ...J:9...|.N'.cS.0.......-..^..#.3.4L....(....g.OH1j ..!..O.~..@..j._W..APsr|l..Y+.;n..Z...M..w=.]).Y...$G'r.[..P

                                                                                                                                                                                                                                Chrome Cache Entry: 898

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):6953
                                                                                                                                                                                                                                Entropy (8bit):4.97426625305529
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:c3q9R1ETjY1k9kudJQphE2HcjHVSdDtIYIsFsiLQ96ziV:r9zEfWWkwJQphjHgkvIYJi0QF
                                                                                                                                                                                                                                MD5:645F01C1901427F176085F2F984C6139
                                                                                                                                                                                                                                SHA1:AA5E66A1B49B4840EF30B765712178DA237CD74A
                                                                                                                                                                                                                                SHA-256:18D91A4732D34F80E3B785F0EE2F3FA5102582D5DA3BC44C76AFBCF87D5E4A50
                                                                                                                                                                                                                                SHA-512:6913F0471E4510FC5B95A7317C2347B6B5835973BBFC5F51A28A9EC6AF2A29D67BEC4B4B1A434A19610F75A8547C584582FC690E5392B466D534EB5876BEAEF2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/no_input.mp3:2f7070b0ccf2ad:0
                                                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..`.................................................@..................................%trak...\tkhd....................`.................................................@...............mdia... mdhd.............D..`.U......"hdlr........soun.................wminf....smhd...........$dinf....dref............url .......;stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts...................(stsc...................................tstsz...............................................................{...q...h...d..._..._...W...^...b...U...K........stco...............|....udta....meta......."hdlr........mdirappl.............oilst.....nam....data........cancel....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 0000

                                                                                                                                                                                                                                Chrome Cache Entry: 899

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):474
                                                                                                                                                                                                                                Entropy (8bit):4.7449073607550805
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRGLHuojuMUMU2lX9KuMUMU2lZzrvCJig/I3n8:t4jU/vjtuM5JlX9KuM5JlZ/qwX38
                                                                                                                                                                                                                                MD5:CF92CBEE09BC23E2B2EAE3EF6A9DFF40
                                                                                                                                                                                                                                SHA1:E9EEB3AE2294064FD7B0A5026B5AE02A6564C9AD
                                                                                                                                                                                                                                SHA-256:60FC606F480F263CDC9CF180089D42E4A070395B47D0331E7C869A9F6FD2208A
                                                                                                                                                                                                                                SHA-512:EF4944E4E9FE78DD00D379EE192FEF915BC3AA45E6029AC21CA858C5C8D65EBDFA70F78CF87F00A623D311CC3ABF453CFD5DFFEC442F1A87EAE23E548DF92295
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/gaming/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 12H8v2H6v-2H4v-2h2V8h2v2h2v2zm7 .5c0-.83-.67-1.5-1.5-1.5s-1.5.67-1.5 1.5.67 1.5 1.5 1.5 1.5-.67 1.5-1.5zm3-3c0-.83-.67-1.5-1.5-1.5S17 8.67 17 9.5s.67 1.5 1.5 1.5 1.5-.67 1.5-1.5zm-3.03-4.35-4.5 2.53-.49.27-.49-.27-4.5-2.53L3 7.39v6.43l8.98 5.04 8.98-5.04V7.39l-3.99-2.24m0-1.15 4.99 2.8v7.6L11.98 20 2 14.4V6.8L6.99 4l4.99 2.8L16.97 4z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 900

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):211
                                                                                                                                                                                                                                Entropy (8bit):5.119467255389257
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI42IBIAFzKVN/YWAIQfgZi:t47N9U/vmR2I+jVyIKg8
                                                                                                                                                                                                                                MD5:914B3584E764344B898D1431747A8A4C
                                                                                                                                                                                                                                SHA1:C870050A1AEB28C22867785E93A304794375FCD2
                                                                                                                                                                                                                                SHA-256:B9E9D5F5F7AF96C4272B4ECE21F8B568F8B03D70D6ABA3DEBA5F823E81796F15
                                                                                                                                                                                                                                SHA-512:A8040E77D002823D9D190822C23A4619052CAB4DB0E18658ED62DD50254E96ECB47A7D0F776977F404D60DF839AFD447A5061B564CC8DBA4A0F6A1B47BA5D2AA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/trash_can/v5/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M11 17H9V8h2v9zm4-9h-2v9h2V8zm4-4v1h-1v16H6V5H5V4h4V3h6v1h4zm-2 1H7v15h10V5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 901

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:XML 1.0 document, ASCII text, with very long lines (540), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):540
                                                                                                                                                                                                                                Entropy (8bit):5.0953958403229755
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:TMHd2yqNZNNUrS7n4nuL0EGuSl6FGYdB2GSuh43JPYa0:2d2PNdUrS7nfcuSQ8YdqXya0
                                                                                                                                                                                                                                MD5:AABAC4B67E56DCAAA0C06DCEA2C8C7EC
                                                                                                                                                                                                                                SHA1:4AEC6ABB0BCB8B6828F0CFE62637D3B270FDEA6C
                                                                                                                                                                                                                                SHA-256:96D0C3380F81C5C429B2FAB04F6A9961F83287D1922A1B44A1DBD4A4004D62B6
                                                                                                                                                                                                                                SHA-512:C9709D6C0A2EE21148E5D8826A3093E3A353B7D2BA0C135924EA8079982A8475F71B5926AFE6F21FF67C2538574D2F6EC0C20C97ED836F6A67799EA05D20AC6D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/opensearch?locale=en_US
                                                                                                                                                                                                                                Preview:<?xml version="1.0" encoding="UTF-8"?><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/"><ShortName>YouTube</ShortName><Description>Search for videos on YouTube</Description><Tags>youtube video</Tags><Image height="16" width="16" type="image/vnd.microsoft.icon">https://www.youtube.com/favicon.ico</Image><Url type="text/html" template="https://www.youtube.com/results?search_query={searchTerms}&amp;page={startPage?}&amp;utm_source=opensearch"></Url><Query role="example" searchTerms="cat"></Query></OpenSearchDescription>

                                                                                                                                                                                                                                Chrome Cache Entry: 902

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):252
                                                                                                                                                                                                                                Entropy (8bit):4.749518607468393
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slmKkmPUtlXX5xiUSdztsG4J5GXyAajYUNrLVKLbrwPtOTC:t4IrmPoXXmUSBaYaj/rL8LvE
                                                                                                                                                                                                                                MD5:F8F3636F756E2E0E0892FD9E35174490
                                                                                                                                                                                                                                SHA1:6C735659FF64B530A9DA358FEFBF75CB6B14B300
                                                                                                                                                                                                                                SHA-256:2634B0DB38CF06C1261C115FD4B5D56177988D8F4E0CD2597A23EF7A44A94D37
                                                                                                                                                                                                                                SHA-512:47834E3B35CE2C0B1315E637F81AD7996E738C429AFA4E9FBFAC2BD08C26097381F3353F746923FEA16B045117AC4C615726203063CFB8654E7D4C19A273BB52
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/volume-up/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M3 9v6h4l5 5V4L7 9H3zm13.5 3c0-1.77-1.02-3.29-2.5-4.03v8.05c1.48-.73 2.5-2.25 2.5-4.02zM14 3.23v2.06c2.89.86 5 3.54 5 6.71s-2.11 5.85-5 6.71v2.06c4.01-.91 7-4.49 7-8.77s-2.99-7.86-7-8.77z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 903

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):84022
                                                                                                                                                                                                                                Entropy (8bit):7.985828173308768
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:XAxkPBIiUQqRwmgB4Nn9zQbEi8ShMzcfkv3e8rcao:XJpI7QqRwmtmn8vu8r8
                                                                                                                                                                                                                                MD5:22FD61ECA6AAA2666A059738291EFCC9
                                                                                                                                                                                                                                SHA1:A4838A9BA28482CC12C66CA19B996121EED7D99A
                                                                                                                                                                                                                                SHA-256:3FAE2DC84C01F9B0C4905C71164C0828D7D4719DAB6FDCBAEEE385AFC0A7C8CD
                                                                                                                                                                                                                                SHA-512:C8CAAF5C2E4A07F2F08989560B9B162311E6D3D07E6F0EF09E40D30636565BA308E3304BC726093A0464849DC4FAB7BF9D1F797AEDE96EBBF132ED8A3C90F38E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426142063_311525231909394_2466532326268142264_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=wjEk1h2olY8AX_vgjRn&_nc_oc=AQkdwsR45cpue1a-9Qv0t91qJKCiife6rXCL9qsTlITdUMEh4blH9_otjn4Jwh1ajis&_nc_ht=scontent-lga3-2.xx&oh=00_AfCIvYolrMJZG-AwgbFcC7Nuivy-KDKfeRxIIERODcVOIQ&oe=65DB169B
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000a720000051560000835a0000925d0000468a00005ccc000092d200000ed90000f8de000036480100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((...........".....................................................................................;....7..../wr.Z.^F..$.Gr...=X...$X..X.S.....N.......r.EEQ\.../...|NJb....e|...X.$...Mj...+.{cf.)Z..x..|..QW....#.".@..Q.[....)a._....Y)]..@q....Y,*BD.*....!`...Vr...g*r.s...SKn..)d9.S-..JQ/...sSW4.<~O..}.......u..r...E.S..q+.=...^.{...W'..V*./r.2E.yc.#)9$..{).U...4...&f.$.C..@.P..J/UC.....4.2a...!.u.......w..7..W..yDw,...W'.V...........<L...HV-..V_.3..*....... ..I..w.M...=......|.6..Y.."./.H.>.h.....H.QY=}6..].2..{W.|....v...].+V...........W..*...#..H.{^9.u...wq..r..TS.....S.Q.A....'*...PN6zJ..t..]WL@.u[V./..GwN....d.K...i....|M,y.../=+..\..UG.^TE...p.5.#..s..r....w).9Z

                                                                                                                                                                                                                                Chrome Cache Entry: 905

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 192 x 192, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2106
                                                                                                                                                                                                                                Entropy (8bit):7.554456957317547
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:EWP8JUaPVKWwCtcHB3sXXRBJ3v8qkZ/aWr/3KZerMLvSOxJ3Df8sfqV1:lkJVKWw03XXZ4Meo931fq
                                                                                                                                                                                                                                MD5:6452ED75C53E1A8E90A664DF18959A90
                                                                                                                                                                                                                                SHA1:AC01FC2F40F0E4808E22A9C569F3775F0F15A5E2
                                                                                                                                                                                                                                SHA-256:C7BAC3E7016DFC7EB5787579BAC6B975B433FC1A9C279DAFC35649D4782F2061
                                                                                                                                                                                                                                SHA-512:4B23F7FB31826943CBA6496BD74DC620C8EC3B8F0525497E825F1F1F87486335D4374F85417458C3C3E018C2215B9B419D7DE77CB67AAE9EA619038432E1EB10
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/y0/r/eFZD1KABzRA.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR.............e..5...YPLTEGpL.e..e..e..p..e..f..f..h..f..f..`..`.....g..f..f..g..g..f..f..f..g..f..h..e..f..d..g..e..e..c..f..f..e..f..g..g..e..f..f........i..h..e..f..f.....e........e..g..f..f..f..f..f..f..g........f..e..e.......F........................f....F.....d........'y.....p....E.....U..7..t.................6..t...........U.................................p......uy...LtRNS.0`..... ......p..._....@..@..oPP...O.^..__....0.o.o.oO..p.P.P_n. ..@0..P........DIDATx..YS.G..G.]..N...t.6&.$..8v|.>{.."....m.3...../...X...*./.....z..Z...^-."|GT(T.K..Z..n..z.3..BT..Z....\.)..Y.....)..\XZs%..e../...........:....Z.R...,X...B....VCL......".~)P...@..P..8......YG..<...=..BLs..CX........0..J...I....Z..,....0g...i...B..}6.Eh.$.g.D1.k......... ..WYD....O..b~.~......U..s4..?...d0........x.g7.zF...........9..G*.A...~...=#.w0.1Z......K..BV..>....x.p...<LS...ft..(|...2XDE.Q...yc..$Mu.@.L...R=.X,.H....!.X).j../.-q2.....09.........\...&.bYk........j.o......../.u}..(5!.

                                                                                                                                                                                                                                Chrome Cache Entry: 906

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):259
                                                                                                                                                                                                                                Entropy (8bit):4.934032927917805
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6RlUFDA:t4noU/vmRxxVzMHUFX4Q0
                                                                                                                                                                                                                                MD5:F3AFFCB5D33857F7701EA77BB03026C8
                                                                                                                                                                                                                                SHA1:18EEE961EA2690791898EBE6A1BEE7C6DF0DA051
                                                                                                                                                                                                                                SHA-256:E3B0DCD76E8387AC87E54B1153DF400D9D5D2079DBA7AFB04AB0A31F8E50B173
                                                                                                                                                                                                                                SHA-512:D07A81CD18096FB5C3B6549950EAB68DA45651E1209F1CDF6441CFDE01050C6E5A0FC596A45B761F3D387902DF3F1706BBE7F97DDBBBD11AAEEC83A70D08F3DC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/trophy/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zm14-1-2 1V6h2v4.38z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 907

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):563
                                                                                                                                                                                                                                Entropy (8bit):4.367744360532535
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4noU/vmRTKd2aCJAzyXDMhkVFCzzZvSbeW03LxgI:t4oU/vo49yXghf5UTI
                                                                                                                                                                                                                                MD5:3102D9E6EB6482A42839EFF1E5F4CB83
                                                                                                                                                                                                                                SHA1:151E7A7B018C590EFF801936C8B3165E21D1F388
                                                                                                                                                                                                                                SHA-256:A79054C0A39DB68BD70F2277EE512312190F32D0CCFB12B2B15A8DC833DA4772
                                                                                                                                                                                                                                SHA-512:4131362A77102F48C615E40ECC95599300A239BF339831DA47E85A328929EAAB6AC63B67D64CE6FCBEB120D85865F5415C2188877822861BADCE5B908D206A0B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/person_circle/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 1c4.96 0 9 4.04 9 9 0 1.42-.34 2.76-.93 3.96-1.53-1.72-3.98-2.89-7.38-3.03A3.996 3.996 0 0016 9c0-2.21-1.79-4-4-4S8 6.79 8 9c0 1.97 1.43 3.6 3.31 3.93-3.4.14-5.85 1.31-7.38 3.03C3.34 14.76 3 13.42 3 12c0-4.96 4.04-9 9-9zM9 9c0-1.65 1.35-3 3-3s3 1.35 3 3-1.35 3-3 3-3-1.35-3-3zm3 12c-3.16 0-5.94-1.64-7.55-4.12C6.01 14.93 8.61 13.9 12 13.9c3.39 0 5.99 1.03 7.55 2.98C17.94 19.36 15.16 21 12 21z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 908

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):190
                                                                                                                                                                                                                                Entropy (8bit):4.7187854291824936
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRvFjonQFWL4UUk+uUQRNru7u5WLp+:tI9mc4slhohC/vmVR9MQF1Nk+bQLL0LA
                                                                                                                                                                                                                                MD5:DFF69AA895E01665A126FC2141C94FE5
                                                                                                                                                                                                                                SHA1:4064D2365E13C8A346B1D4BBE31BECD3A18CF5B1
                                                                                                                                                                                                                                SHA-256:811E9985BE1AC4E4D630F4B232CEEE366801CB5F82EE306A574C1CE9F844F673
                                                                                                                                                                                                                                SHA-512:CDC9FC460CBDA1DA0EF8E7A079FCBBF717E800F732923607DFBFA57E00FD3E8A2B487E9D2FEA95294DEDBA9DA5CFD42491BD3AC65219AEC954A20CB90FDE49B5
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/arrow_up/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="19.35,11.5 11.5,3.65 3.65,11.5 4.35,12.21 11,5.56 11,20 12,20 12,5.56 18.65,12.21"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 909

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):147
                                                                                                                                                                                                                                Entropy (8bit):4.91608759200102
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHxKFUV12pppTJQrK/:tI9mc4slhohC/vmI4xKPJTeri
                                                                                                                                                                                                                                MD5:BB349544319961A969D3B459602BC671
                                                                                                                                                                                                                                SHA1:961C29B064625EB266A084F294F970E0A2A953DB
                                                                                                                                                                                                                                SHA-256:489A97893CC1E6CD9267CB6B39BCC7DDC0D119A19408EF3B80E4F3798C78B1FD
                                                                                                                                                                                                                                SHA-512:56168B9E178135D180DE402FFD8BD2D0412CB86C40831CBE709A4034F0FCB628A12096C3981D487FF48E134558701F8F1A458BFA0E48402C8A4FB32C0A9393A2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_up/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18.4 14.6 12 8.3l-6.4 6.3.8.8L12 9.7l5.6 5.7z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 910

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):154
                                                                                                                                                                                                                                Entropy (8bit):4.827221770489101
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHTdEBhHIHWlYqY:tI9mc4slhohC/vmI45EBho+u
                                                                                                                                                                                                                                MD5:FFFE8FD3C6ACCC2FCFDD7B66EA25B99A
                                                                                                                                                                                                                                SHA1:13C31200084CB1EED7A746428D2B79AD34FF6790
                                                                                                                                                                                                                                SHA-256:55A060294343CAFA3539424536540547F25EFD13A1D2373D7A5E966CE74C5699
                                                                                                                                                                                                                                SHA-512:A6D8EB0393B4FB56D4B6025865F542B29AFEFAF7BB2B26E55C5B54974EB3B913E9A17AD54A8FE33525345AF3AD16EC60C06356582F72B3864731EC22C1838662
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_right/v4/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m9.4 18.4-.7-.7 5.6-5.6-5.7-5.7.7-.7 6.4 6.4-6.3 6.3z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 911

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 512x288, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):123601
                                                                                                                                                                                                                                Entropy (8bit):7.981979795963409
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:iPmzHaW4Xo3h9V7IUpDYMm4QN2HsUrY1SejKv8L:ska5m9Vb0Mm4QNoxE5jTL
                                                                                                                                                                                                                                MD5:8C2E434FEB70F2E6D3931FCFC4ED94CA
                                                                                                                                                                                                                                SHA1:DF565ED175DD4947BEE07FAADEE29EECADBED330
                                                                                                                                                                                                                                SHA-256:ACB156D26E44C6E5B2DEEB6D856C2441B541E594BE51099945059B599C401D8D
                                                                                                                                                                                                                                SHA-512:4F80740712C0F155239E846F8119D98F9055A38ACA8AFCD783A9BBED0FFC796F32D401730DA5059AFA0AF14CBA9BDA22C4682DAA294726E170990108D63B039D
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://lh3.googleusercontent.com/3qmZKTLiM5SzdFKmWCCMWEti5558zSXzCzRY_ZBt2Q9UlB6hc4Nh8UuN2LNRgfKgkdqgU6lIJSxm
                                                                                                                                                                                                                                Preview:......JFIF...................................................................................................................................................... .............................................a..........................!..1."AQ.#24Ta....$3BRqst......%5CSUru.....b.....DEVcd.....e....6.....................................Z.........................!.1A."Qa..2q.......34BRSTrs.....#5Ut....$Cb...%cu..Dd....E.6..............?...j.MSDQ').J.."...M+a'.h........<s.?.*....$,6.@J...N.JN...k...3...1..."w...?.9..'....S.....o%....j../.}Z..s5*..v...e.B[.z...-_$ ...2p...K.YM1p.$..j...9u.`...m5...]m....{.'I...e........zo..).g.......)..C.....6.2.>f[..\..!......X.}.\..v.......T.P.&.......!%yw.Y..c..-.%9........>.;.9..'....S^....o%....j../.}Z.5i........p..(Q.iZt.).1C..G..3..n,..U.X{....K. ....I$..&I...y2.3..:......=.q..t.#..f.N..W.m..?.L]......}Z.D.&...iy.6.....OQlm.....c.Bz.......J...t4.y.RH@1.F..(......V...'1T$.1<z......G............t....._w.jm..,..)CT.:.5...o..yU......4

                                                                                                                                                                                                                                Chrome Cache Entry: 912

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):359
                                                                                                                                                                                                                                Entropy (8bit):4.955472444225813
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slzXdhC/yZqRIuZUoMLWlvSLrk91MLP25RjkxSRcATBrREjlC:t4BdU/mD8tKv9iDjkwRFTlGjI
                                                                                                                                                                                                                                MD5:7EC75F80BDA2F53D6568AA6412D83431
                                                                                                                                                                                                                                SHA1:9A94D2C509FE96BBD5A02971F066A1C1EEC6B3B6
                                                                                                                                                                                                                                SHA-256:D8869F288C1E21A843123729543F5677E9B28349789C2282609CEC8ABC4DE9C1
                                                                                                                                                                                                                                SHA-512:B2F2FE075F4AA2E0D73B4BF7B7F8BE3F43C6E6A7BF93165BE3178B7A20F5B0AE3B6CDC467B502EFEFE0337D5A98FA7039C224A3CDA6F455D70622B769314935B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_shorts_brand_24/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24">. <g>. <path d="M17.77,10.32l-1.2-.5L18,9.06a3.74,3.74,0,0,0-3.5-6.62L6,6.94a3.74,3.74,0,0,0,.23,6.74l1.2.49L6,14.93a3.75,3.75,0,0,0,3.5,6.63l8.5-4.5a3.74,3.74,0,0,0-.23-6.74Z" fill="red"/>. <polygon points="10 14.65 15 12 10 9.35 10 14.65" fill="#fff"/>. </g>.</svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 913

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):406
                                                                                                                                                                                                                                Entropy (8bit):4.651423707267608
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4noU/vmRpRD3kuFTUgF1rwnSh0HBSDK+TFmGbu:t4oU/vk1kuFTHFASh0HBJ+S
                                                                                                                                                                                                                                MD5:07316364645FFB2C33FC257FCFB34571
                                                                                                                                                                                                                                SHA1:889C3EBC5FD9ED8556FABFD1C7B255D57E46B60B
                                                                                                                                                                                                                                SHA-256:0F10421652B17118A44D84E207A04BB972DBF38C444D56C1701F8E961FB6FF4F
                                                                                                                                                                                                                                SHA-512:3B4CCF3C9DF86926DB5765CFF9764CBAEEF277631D8D703C956CCB9071E124DBA9A398DEA8D1DE20CDEFC6E4ABDACAC637FF2D97141F4AB9284A830F20F534C9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/volume_on/v3/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M17.5 12c0 2.14-1.5 3.92-3.5 4.38v-1.04c1.44-.43 2.5-1.76 2.5-3.34 0-1.58-1.06-2.9-2.5-3.34V7.62c2 .46 3.5 2.24 3.5 4.38zM12 4.07v15.86L6.16 15H3V9h3.16L12 4.07zm-1 2.15L6.52 10H4v4h2.52L11 17.78V6.22zM21 12c0 4.08-3.05 7.44-7 7.93v-1.01c3.39-.49 6-3.4 6-6.92s-2.61-6.43-6-6.92V4.07c3.95.49 7 3.85 7 7.93z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 914

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (41541)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):74197
                                                                                                                                                                                                                                Entropy (8bit):5.4551136708766705
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:1pbgXdxJkYuOm3Q+gXHcJXEal5yl/kPHTO677Y8PouA/sqk92474oIhfc0fnraJp:veHchBCdo25qMKcuktHzX+6UevL8F
                                                                                                                                                                                                                                MD5:1A385461F30E3F360D31F242FD6B3D98
                                                                                                                                                                                                                                SHA1:0C0D69D3D866E93732265776AE44FD02DB855D99
                                                                                                                                                                                                                                SHA-256:F89934AC0709430477B8A664F72035461A08E79AAB91944D71D695660D810C13
                                                                                                                                                                                                                                SHA-512:8F5957C1FB9DA9BC831E688F66F4DE1362ED2A2B7A557F9607C7DD93F99D7E07A339B52C350CE1CC236EC5A2B84AE9CE7FF53F12319C967CC4A3D6C5DDCFF161
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/1jvrml64dlmt60uoawzo2af88
                                                                                                                                                                                                                                Preview:!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=108)}({108:function(e,t,n){"use strict";n.r(t);var r=n(7),i=n(43);const o="PageViewHeartbeatE

                                                                                                                                                                                                                                Chrome Cache Entry: 915

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (511)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2051
                                                                                                                                                                                                                                Entropy (8bit):5.245569770149611
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:x2npr4QxmTJsIxHPTNSxf0gzu590yKECxex3XZKE+:x44wmTJsYH7NGf0gKT0yKE2K3pJ+
                                                                                                                                                                                                                                MD5:A94E7CD86F5824E27720F5D3C712DF9A
                                                                                                                                                                                                                                SHA1:7BF52949685727D7133F452B432A57615E40978F
                                                                                                                                                                                                                                SHA-256:59CE6BDF8E3D17BB68667499C34A3EC32B9F7836DBCA59D03237A4C9FFFEFD35
                                                                                                                                                                                                                                SHA-512:726D7BB3C7D356453A10D590EE4806BDE864FC7E909BA8F03E194B1F1BAA0D65AE8FC89E9E393F2300ED3536969E7445AC39860E3BB0EA338EF19F4B51139B9F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js
                                                                                                                                                                                                                                Preview:'use strict';/*.. Copyright (c) 2016 The Polymer Project Authors. All rights reserved.. This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt. The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt. The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt. Code distributed by Google as part of the polymer project is also. subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt.*/.(()=>{if(window.customElements){var h=window.HTMLElement,m=window.customElements.define,n=window.customElements.get,k=new Map,l=new Map,e=!1,f=!1;window.HTMLElement=function(){if(!e){var a=k.get(this.constructor);a=n.call(window.customElements,a);f=!0;return new a}e=!1};window.HTMLElement.prototype=h.prototype;window.HTMLElement.es5Shimmed=!0;Object.defineProperty(window,"customElements",{value:window.customElements,configurable:!0,writable:!0});Object.defineProperty(window.

                                                                                                                                                                                                                                Chrome Cache Entry: 916

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (2164), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2164
                                                                                                                                                                                                                                Entropy (8bit):5.007692541572839
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:/CpDuMY6wRQAQl07kBeFxDKNpK9xvj+Zy3t:/snIQAFhRl
                                                                                                                                                                                                                                MD5:68225657C41B94DFDD7669563FA18C80
                                                                                                                                                                                                                                SHA1:58E43494BC31122F06FCB3AA3764BE2883D0618F
                                                                                                                                                                                                                                SHA-256:72BCCD36C17AA93A7BB553557626BB720BE60CDE2357D817BD03AF6BE67CF08E
                                                                                                                                                                                                                                SHA-512:18441A68B88395A98A1721CE772AA98D0A05AC080E4C7C2A8A0598F46837FCFF8A1C5978E6A0C3146A088CCA632ED43B377FF63DB15195976AE958D35E9FB1CB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/65xtw2y5evpkuq3vtf8wiydts
                                                                                                                                                                                                                                Preview:!function(e){var t={};function n(o){if(t[o])return t[o].exports;var r=t[o]={i:o,l:!1,exports:{}};return e[o].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,o){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:o})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var o=Object.create(null);if(n.r(o),Object.defineProperty(o,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)n.d(o,r,function(t){return e[t]}.bind(null,r));return o},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=91)}({91:function(e,t){var n=document.querySelector(".language-selector"),o=document.querySel

                                                                                                                                                                                                                                Chrome Cache Entry: 917

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (405)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1600
                                                                                                                                                                                                                                Entropy (8bit):5.234459115233662
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:kMYD7i1NPxJ3nktBNuryNPxyhzs/fdkTRxuAoMylW6MumIcu2yNPxxQ34OZI86y2:o7iHY0rs9ORxvoMylxr2sQJ7DNzfrw
                                                                                                                                                                                                                                MD5:967DFEEC6A7FD39DC7FE665E776702E2
                                                                                                                                                                                                                                SHA1:AA15F9DF789871C3AFAC0D31962E1E71F1D9CD58
                                                                                                                                                                                                                                SHA-256:D432D0BB701BE738D8E070DBFAEE681AB412F157E5ADBC63099309FC2DFF6252
                                                                                                                                                                                                                                SHA-512:461D5EE5A265CD8DEFD3EB0C286DAA5DAC8C115621CA9420694DA308093C0DA6280B3366B3C1ED5B4BF106CB2BC9AAB827E63B36D4E71447153581ADB18298AA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.uf(_.hia);_.Yv=function(a){_.I.call(this,a.Ha);this.aa=a.Xa.cache};_.B(_.Yv,_.I);_.Yv.Oa=_.I.Oa;_.Yv.Ba=function(){return{Xa:{cache:_.gp}}};_.Yv.prototype.execute=function(a){_.wb(a,function(b){var c;_.qe(b)&&(c=b.Za.Nb(b.fb));c&&this.aa.JC(c)},this);return{}};_.Lq(_.Cia,_.Yv);._.l();._.k("VwDzFe");.var KE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.Oq;this.ea=a.Ea.metadata;this.da=a.Ea.Fq};_.B(KE,_.I);KE.Oa=_.I.Oa;KE.Ba=function(){return{Ea:{Oq:_.kE,metadata:_.lUa,Fq:_.hE}}};KE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.wb(a,function(c){var d=2===b.ea.getType(c.Bd())?b.aa.fc(c):b.aa.aa(c);return _.Tj(c,_.lE)?d.then(function(e){return _.Wc(e)}):d},this)};_.Lq(_.Hia,KE);._.l();._.k("sP4Vbe");._.kUa=new _.qk(_.Dia);._.l();._.k("A7fCU");.var pE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.nL};_.B(pE,_.I);pE.Oa=_.I.Oa;pE.Ba=function(){r

                                                                                                                                                                                                                                Chrome Cache Entry: 918

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (4919)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):772056
                                                                                                                                                                                                                                Entropy (8bit):5.5678482355962
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:Jme85Yf5fEt77xSzVJXd44E8F6t7AnP7hLPGMZQ+jVkta9HAMBelqm5g:iZSzV4j7APjVktnwX
                                                                                                                                                                                                                                MD5:A53FC66830FEC891050128336C7DBD83
                                                                                                                                                                                                                                SHA1:C279226A7D187A68D1222C68B6249A08A0253893
                                                                                                                                                                                                                                SHA-256:E2DF3CDDEDA0096553AA58FB88E2112B2142F57D06F8B3A5FF4C4B0CB52D6439
                                                                                                                                                                                                                                SHA-512:6533C8B5814EB29A03A59053820FC3D3E1435D48F75A94EAAC6F35FB5BEF6566658507CBEA6A6663258932F5870E339C77C6678AA2D66005122F91571B1B3817
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3ild_4/yJ/l/en_US/-__AvVAHG01U8FT9fvt0sgNb1n1Dnz-toWuECcer9ZzpLIj9cqpcLjQD4AgT6FzeeVDYvatkvPhoO0d94eNKnR7lOuDENWdRgBu3JfZvdWL_j91Rdzuzi16ygGc1wa-Oq19cevyCvEVQbD2OmPobANp9KHpDnYRWx5vjU9zGmt_6UlA-lU_6SmVEaVrlFSHhTt9z8sp55HfXW__mMgFRlCsGN0FHwCFoDf7C27gzi95_wmB-51YxoStyBz2gEpqWzCjqUWMgaogygfp_uoh2pEQn4HVER6y-GdB52bvQ0.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometLogInHiddenInputs_data.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a=[{alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"value",storageKey:null}];return{argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometLogInHiddenInputs_data",selections:[{alias:null,args:null,kind:"ScalarField",name:"prefill_contactpoint",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"prefill_source",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"idd_user_crypted_uid",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"locale",storageKey:null},{alias:null,args:null,concreteType:"LoginNameValue",kind:"LinkedField",name:"lsd",plural:!1,selections:a,storageKey:null},{alias:null,args:null,concreteType:"LoginNameValue",kind:"LinkedField",name:"jazoest",plural:!1,selections:a,storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"login_source

                                                                                                                                                                                                                                Chrome Cache Entry: 919

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):415
                                                                                                                                                                                                                                Entropy (8bit):4.495473856679165
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4noU/vmRIESMmpa8gQL8nJK18IyNzT+OjHf8:t4oU/vwSMcNgQL8nJKCzN1jHf8
                                                                                                                                                                                                                                MD5:AEBBF536BB5109D9C8BA51BB520CC801
                                                                                                                                                                                                                                SHA1:EEF20371B44CC4E85027D01DBB2690DED70DF957
                                                                                                                                                                                                                                SHA-256:E2A570823965E0A19930FAED9A0C8213AF0092327BFE7041F5A50D7E6312360F
                                                                                                                                                                                                                                SHA-512:A65789396E46C765EC4874AAE6996C12145CBD9C8C2E17E0B47AB80E33FD4F6D0FC13B9F282B72AC1A8F32A1D5953E97C1CF483E36A04B2C2E68E921E48B8510
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/youtube_shorts/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m17.77 10.32-1.2-.5L18 9.06c1.84-.96 2.53-3.23 1.56-5.06s-3.24-2.53-5.07-1.56L6 6.94c-1.29.68-2.07 2.04-2 3.49.07 1.42.93 2.67 2.22 3.25.03.01 1.2.5 1.2.5L6 14.93c-1.83.97-2.53 3.24-1.56 5.07.97 1.83 3.24 2.53 5.07 1.56l8.5-4.5c1.29-.68 2.06-2.04 1.99-3.49-.07-1.42-.94-2.68-2.23-3.25zM10 14.65v-5.3L15 12l-5 2.65z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 920

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (8178)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):78003
                                                                                                                                                                                                                                Entropy (8bit):5.53405780264124
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:qgd6FF6U5v/FSisNk3a+awDbDit1/W+m4oVxmb5EhI2iCqD:qFs1/W+mAShI2rqD
                                                                                                                                                                                                                                MD5:5917697495FB37C5EF3FB0DA4DBA603D
                                                                                                                                                                                                                                SHA1:E0AD2EC691AB197AB9B35A38E7E6BBD56E26BBE1
                                                                                                                                                                                                                                SHA-256:FC79501E066AB041FF87F2E122741B8FA48A4A5B47CEF76D29E49C15D43389FA
                                                                                                                                                                                                                                SHA-512:861DD39C6DE2A006A28F16FB3E91417DF8AC4607C383F28A34579DCE714FEEFEF61860B4A731055DF3DD8C12BD0EA144C9B2868AC920F93F3D6AE741729B1833
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3ig-p4/yx/l/en_US/JryzzQ6rPykHu1lo-vtGQXW_mJPSArgBuDwcaXkOToVitoYGhfwcfLeHjcTTYJxU54xsw_y3zVOBSd8w70Ttksmt5r1v89-9txafWxL1rr0Obq.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometTextWithEntitiesRelay_entity.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a={alias:null,args:null,concreteType:"WorkForeignEntityInfo",kind:"LinkedField",name:"work_foreign_entity_info",plural:!1,selections:[{alias:null,args:null,kind:"ScalarField",name:"type",storageKey:null}],storageKey:null},b={kind:"Variable",name:"scale",variableName:"scale"},c={alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},d={alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},e={alias:null,args:null,kind:"ScalarField",name:"width",storageKey:null},f={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null};return{argumentDefinitions:[{kind:"RootArgument",name:"scale"}],kind:"Fragment",metadata:{mask:!1},name:"CometTextWithEntitiesRelay_entity",selections:[{alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},{alias:null,args:[{kind:"Literal",name:"site",value:"comet"}],kind:"ScalarField",na

                                                                                                                                                                                                                                Chrome Cache Entry: 921

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (7725)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):8050
                                                                                                                                                                                                                                Entropy (8bit):4.920561681304313
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:CTRGUcHwbE2ZH0LqEcbuCUY3bkQsS6SxSrxLFvH7WJdJw:IGUcHVqEcbuCp3bkQspksxLAJdJw
                                                                                                                                                                                                                                MD5:F094C2EBE9C25B421CB4A265CA0055DD
                                                                                                                                                                                                                                SHA1:C22C656B5E201823B4F2B25D8986A60A3D85064F
                                                                                                                                                                                                                                SHA-256:C61EF8CDE8EEBD5F62E08615723A6419C23FB8FA6F53F4BDF2EFFB382A75B3BF
                                                                                                                                                                                                                                SHA-512:7855E0621651FEE73C016BD84A2FE7FA5C0CBB8F6DABD64533899702486E82D41868B78B1AA0BDD0555E57B63E082DA4022B768DA26E22EB417599F1EFF80DCA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/sw.js
                                                                                                                                                                                                                                Preview:/** 12748399114155721543 */self.document = self; self.window = self;var ytcfg={d:function(){return window.yt&&yt.config_||ytcfg.data_||(ytcfg.data_={})},get:function(k,o){return k in ytcfg.d()?ytcfg.d()[k]:o},set:function(){var a=arguments;if(a.length>1)ytcfg.d()[a[0]]=a[1];else{var k;for(k in a[0])ytcfg.d()[k]=a[0][k]}}};.ytcfg.set({"EXPERIMENT_FLAGS":{"H5_enable_full_pacf_logging":true,"H5_use_async_logging":true,"ab_det_apb_b":true,"ab_det_el_h":true,"ab_det_fet_wr":true,"ab_det_fet_wr_en":true,"ab_det_gen_re":true,"action_companion_center_align_description":true,"allow_skip_networkless":true,"clear_user_partitioned_ls":true,"compress_gel":true,"csi_config_handling_infra":true,"deprecate_csi_has_info":true,"disable_child_node_auto_formatted_strings":true,"disable_pacf_logging_for_memory_limited_tv":true,"disable_simple_mixed_direction_formatted_strings":true,"disable_thumbnail_preloading":true,"embeds_transport_use_scheduler":true,"enable_ab_report_on_errorscreen":true,"enable_ab_rp

                                                                                                                                                                                                                                Chrome Cache Entry: 922

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 49 x 74, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1633
                                                                                                                                                                                                                                Entropy (8bit):7.352151724937379
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:Qy3Hwa/3ffWoAf6t+snxsGhlYUcGwMMQ1:xQaXfKG+IJcJM51
                                                                                                                                                                                                                                MD5:72EE577BCC1A6A29D0422C3EB1248861
                                                                                                                                                                                                                                SHA1:800818D8D4A3E67D49ED2A3A935B355F8452DDDD
                                                                                                                                                                                                                                SHA-256:97FADFDD7D274DAABD9F7D79C817F4A9FACC08EBA67E38284698525E8A1FFFD0
                                                                                                                                                                                                                                SHA-512:A373DB5E786A91D299394B45D707A067CEC708966B8757BF84F5BEF0F167E7EE4388C4356468526A6A8B4AD3521773FE78FDE18422B16F730D9116245544171B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/7NqDjYL3eb9.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR...1...J.....%.L,....PLTE.....................GpL...........................FFF......ooo...BBB.......................................NNN...uuu...............................................................999..................,,,.........AAA...............444......................................................777...WWW......:::.....................333........CCC........................zzzhhh....."""{{{...jjj.............%%%...555............................................bbbccc.........rrr......sssrrrsss.................................to.K....tRNSfJ....\.Td..hLfl.xP6.\x.....jf..|..N|`........N..R`..n..^.tVp..V.v...z...t.|.."^v.hfBlZX.j...tb..p~b....:4r..x...h......n.......n.t.....`.`.....b....b.................TIDATx^..es#G.....dY`.33...!3C.0.c.....~.|.D+E.f....}.T......j...3..3...)C."...'..........GK._..........J.....%..vw:....D&+5.fl... ..@..Q.4.$.h.&Zb..N.....b-.h.".....R'.b.n...!.T#..N.G.a..UEg.DZ.3.....OtC{......+.7.......E.$...

                                                                                                                                                                                                                                Chrome Cache Entry: 923

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):789
                                                                                                                                                                                                                                Entropy (8bit):4.4194384212801
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:t4takfIIJEGBA8rb0CklxqTaccoUZ/ES2mM:kGGSVC8Giu
                                                                                                                                                                                                                                MD5:B552B4C85CA1E2238DB395B9A49411FF
                                                                                                                                                                                                                                SHA1:D8D5C6B8E8253732F1DD1CCE2F8C4F3C1F1BB1BE
                                                                                                                                                                                                                                SHA-256:949AF1BF7118AF3ADA0A087666E6E763CA627DBEFB1EB2E3B978210CFE808FBA
                                                                                                                                                                                                                                SHA-512:62DC81FC15CE62AFD2C22C36A05C5C5CC6BB4E5231C8BDF11143CFA8C950A6A161B693BE7B93AF6BFD9A0C348D6B4A49D9956706029E1307135B4D191869D837
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/creator_studio_red_logo/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill="red" d="M11.13 1.21c.48-.28 1.26-.28 1.74 0l8.01 4.64c.48.28.87.97.87 1.53v9.24c0 .56-.39 1.25-.87 1.53l-8.01 4.64c-.48.28-1.26.28-1.74 0l-8.01-4.64c-.48-.28-.87-.97-.87-1.53V7.38c0-.56.39-1.25.87-1.53l8.01-4.64z"/><path fill="#fff" d="m12.71 18.98 4.9-2.83c.41-.24.64-.77.64-1.24V9.24c0-.47-.23-1-.64-1.24l-4.9-2.82c-.41-.23-1.02-.23-1.42 0L6.39 8c-.4.23-.64.77-.64 1.24v5.67c0 .47.24 1 .64 1.24l4.9 2.83c.2.12.46.18.71.18.26-.01.51-.07.71-.18z"/><path fill="red" d="m12.32 5.73 4.89 2.83c.16.09.41.31.41.67v5.67c0 .37-.25.54-.41.64l-4.89 2.83c-.16.09-.48.09-.64 0l-4.89-2.83c-.16-.09-.41-.34-.41-.64V9.24c.02-.37.25-.58.41-.68l4.89-2.83c.08-.05.2-.07.32-.07s.24.02.32.07z"/><path fill="#fff" d="M9.88 15.25 15.5 12 9.88 8.75z"/></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 924

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):16
                                                                                                                                                                                                                                Entropy (8bit):3.875
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:HmnY:OY
                                                                                                                                                                                                                                MD5:C13E70783B272C1B1F38DF78789CB038
                                                                                                                                                                                                                                SHA1:7F182E8DA5EE7FB00A151AC0D205D71E9C017D94
                                                                                                                                                                                                                                SHA-256:8800EFDDF6F05E9F2F4263946E6C5AB296C955138B006CE3A74D3B0F143BE92A
                                                                                                                                                                                                                                SHA-512:A7F5941549D283934D49EE8BF8FA069D387FBDF3BBB86F884F14FD4E10EB5F6E754F55E0F3F94DCE79EF84FA2787A5F9DB8A24C74BA13BAF379DB66BF35FB8F9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8yq_jFOmFmxIFDfGjW-M=?alt=proto
                                                                                                                                                                                                                                Preview:CgkKBw3xo1vjGgA=

                                                                                                                                                                                                                                Chrome Cache Entry: 925

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (936)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):5863
                                                                                                                                                                                                                                Entropy (8bit):5.542506058381083
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:ercpdAw1xFVObY2GhlzSSt0531195315WnGIjkC4EBBIjKuKSwXr6:ekdAMFVObY2GjDm19D5WnGIj8OByKD6
                                                                                                                                                                                                                                MD5:F3356B556175318CF67AB48F11F2421B
                                                                                                                                                                                                                                SHA1:ACE644324F1CE43E3968401ECF7F6C02CE78F8B7
                                                                                                                                                                                                                                SHA-256:263C24AC72CB26AB60B4B2911DA2B45FEF9B1FE69BBB7DF59191BB4C1E9969CD
                                                                                                                                                                                                                                SHA-512:A2E5B90B1944A9D8096AE767D73DB0EC5F12691CF1AEBD870AD8E55902CEB81B27A3C099D924C17D3D51F7DBC4C3DD71D1B63EB9D3048E37F71B2F323681B0AD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js
                                                                                                                                                                                                                                Preview:(function(){'use strict';/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var e=this||self;function f(c,b){c=c.split(".");var a=e;c[0]in a||"undefined"==typeof a.execScript||a.execScript("var "+c[0]);for(var d;c.length&&(d=c.shift());)c.length||void 0===b?a[d]&&a[d]!==Object.prototype[d]?a=a[d]:a=a[d]={}:a[d]=b}.;var g={YEAR_FULL:"y",YEAR_FULL_WITH_ERA:"y G",YEAR_MONTH_ABBR:"MMM y",YEAR_MONTH_FULL:"MMMM y",YEAR_MONTH_SHORT:"MM/y",MONTH_DAY_ABBR:"MMM d",MONTH_DAY_FULL:"MMMM dd",MONTH_DAY_SHORT:"M/d",MONTH_DAY_MEDIUM:"MMMM d",MONTH_DAY_YEAR_MEDIUM:"MMM d, y",WEEKDAY_MONTH_DAY_MEDIUM:"EEE, MMM d",WEEKDAY_MONTH_DAY_YEAR_MEDIUM:"EEE, MMM d, y",DAY_ABBR:"d",MONTH_DAY_TIME_ZONE_SHORT:"MMM d, h:mm\u202fa zzzz"},h=g;h=g;var k={ERAS:["BC","AD"],ERANAMES:["Before Christ","Anno Domini"],NARROWMONTHS:"JFMAMJJASOND".split(""),STANDALONENARROWMONTHS:"JFMAMJJASOND".split(""),MONTHS:"January February March April May June July August September October November December

                                                                                                                                                                                                                                Chrome Cache Entry: 926

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1116)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):74033
                                                                                                                                                                                                                                Entropy (8bit):5.496125678356682
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:4GIr9iykWXc8VV4ucbxiyXdpGupDMbSrOLR0QZWtPWDG4nFjI9rkiDyVO9HI4Ckn:h45nb3nxQIiENg5Bi+C02by5
                                                                                                                                                                                                                                MD5:1D50E206021F1BBACF8EC3080B04264A
                                                                                                                                                                                                                                SHA1:5024B3A6930C7F8D47DE1472B38BA590A657F882
                                                                                                                                                                                                                                SHA-256:9EE512AE80E59BE486F738680AA45ED4E31E7458A0B48F40128637B772224261
                                                                                                                                                                                                                                SHA-512:5E065ED27D57432099060906B79C5B4849236CEE091C7FEDD8D57FC5732E5746AC5E5366497C4F31AE7A79D52EDF82104463A8E042D411820B219940BF2A9684
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&family=YouTube+Sans:wght@300..900&display=swap
                                                                                                                                                                                                                                Preview:/*. * See: https://fonts.google.com/license/googlerestricted. */./* cyrillic-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. f

                                                                                                                                                                                                                                Chrome Cache Entry: 927

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (405)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1600
                                                                                                                                                                                                                                Entropy (8bit):5.234459115233662
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:kMYD7i1NPxJ3nktBNuryNPxyhzs/fdkTRxuAoMylW6MumIcu2yNPxxQ34OZI86y2:o7iHY0rs9ORxvoMylxr2sQJ7DNzfrw
                                                                                                                                                                                                                                MD5:967DFEEC6A7FD39DC7FE665E776702E2
                                                                                                                                                                                                                                SHA1:AA15F9DF789871C3AFAC0D31962E1E71F1D9CD58
                                                                                                                                                                                                                                SHA-256:D432D0BB701BE738D8E070DBFAEE681AB412F157E5ADBC63099309FC2DFF6252
                                                                                                                                                                                                                                SHA-512:461D5EE5A265CD8DEFD3EB0C286DAA5DAC8C115621CA9420694DA308093C0DA6280B3366B3C1ED5B4BF106CB2BC9AAB827E63B36D4E71447153581ADB18298AA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.uf(_.hia);_.Yv=function(a){_.I.call(this,a.Ha);this.aa=a.Xa.cache};_.B(_.Yv,_.I);_.Yv.Oa=_.I.Oa;_.Yv.Ba=function(){return{Xa:{cache:_.gp}}};_.Yv.prototype.execute=function(a){_.wb(a,function(b){var c;_.qe(b)&&(c=b.Za.Nb(b.fb));c&&this.aa.JC(c)},this);return{}};_.Lq(_.Cia,_.Yv);._.l();._.k("VwDzFe");.var KE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.Oq;this.ea=a.Ea.metadata;this.da=a.Ea.Fq};_.B(KE,_.I);KE.Oa=_.I.Oa;KE.Ba=function(){return{Ea:{Oq:_.kE,metadata:_.lUa,Fq:_.hE}}};KE.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.wb(a,function(c){var d=2===b.ea.getType(c.Bd())?b.aa.fc(c):b.aa.aa(c);return _.Tj(c,_.lE)?d.then(function(e){return _.Wc(e)}):d},this)};_.Lq(_.Hia,KE);._.l();._.k("sP4Vbe");._.kUa=new _.qk(_.Dia);._.l();._.k("A7fCU");.var pE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.nL};_.B(pE,_.I);pE.Oa=_.I.Oa;pE.Ba=function(){r

                                                                                                                                                                                                                                Chrome Cache Entry: 928

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):78
                                                                                                                                                                                                                                Entropy (8bit):4.858681545591168
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5KVErcHghI4KuP0WTC:tI9mc4slmR4rTC
                                                                                                                                                                                                                                MD5:5FFB1290441ED5E56850CC92DB640DBA
                                                                                                                                                                                                                                SHA1:ABD55D2B6EE392BBC8A89FDCE5B8560E37119D90
                                                                                                                                                                                                                                SHA-256:C74EF8500A3AE98D1E16F03B030BFD6726DE72A8911FC397D3301E4B9D86369B
                                                                                                                                                                                                                                SHA-512:83826FC55AF7335F3AE5E14CAD4056942F3F9C3FA3781258A771710DE1D32EB3412897F6AC3E09090192BE11EB490F996EB475E7B563EB6CD6B15A8F3A1B008F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/play-arrow/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M8 5v14l11-7z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 930

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):384
                                                                                                                                                                                                                                Entropy (8bit):4.820720215490487
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4CpBSNwLSoD0pVhyVLT7UiHQ3aju2lQjGVT7UinwFju2li:t47N9U/vmRqBKbsL3RQKju2lQ03VwFjs
                                                                                                                                                                                                                                MD5:BD5B52813BF62EC230C9EF682AD48DA5
                                                                                                                                                                                                                                SHA1:AB4B59D9F48A229B4D5C6C6DE9E4BF8D4AF32605
                                                                                                                                                                                                                                SHA-256:179E849AAD715CEDDED335BFB09228C4985D113BC1EC61FB7C95785B8E6D941A
                                                                                                                                                                                                                                SHA-512:7AABEFC130160D98B3EF047EAB303D13DCD0BDEC71A24372716FA060FE35AA91D86B1C10CAACC36B0332E9B3B6E59141EC1B32DF7E50543D0927ED0ACAB881F1
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/gaming/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m16.97 4-4.99 2.8L6.99 4 2 6.8v7.6l9.98 5.6 9.98-5.6V6.8L16.97 4zM10 12H8v2H6v-2H4v-2h2V8h2v2h2v2zm5.5 2c-.83 0-1.5-.67-1.5-1.5s.67-1.5 1.5-1.5 1.5.67 1.5 1.5-.67 1.5-1.5 1.5zm3-3c-.83 0-1.5-.67-1.5-1.5S17.67 8 18.5 8s1.5.67 1.5 1.5-.67 1.5-1.5 1.5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 932

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (645)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):11085
                                                                                                                                                                                                                                Entropy (8bit):5.397976873792712
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:8losmj1Uqu+oCNLuZ08MnpAqntHMfG0v8X6JPRAkZE:JUEoCNLDpN8G0vDn9K
                                                                                                                                                                                                                                MD5:CE762A9D30D6C70BB0516E8CEFC958BF
                                                                                                                                                                                                                                SHA1:DA6CAC9C717DAA3A39F82F3421782C99EDD9329D
                                                                                                                                                                                                                                SHA-256:A9FC343D602527A427E57671D021524A9FF5AF7B3DF1A58900A3B01057BDD8C7
                                                                                                                                                                                                                                SHA-512:230753FBB26E90438DD43874D02FBBB1AD6DB9A0FE76DA978EA47A8CA06FC99DD5E475104ABB5DD25CE222423D9BDA7991FD0EE896386561CD6F9AC10F8932E2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/www-tampering.vflset/www-tampering.js
                                                                                                                                                                                                                                Preview:(function(){'use strict';function n(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function q(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var r=q(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var e=0;e<a.length-1;e++){var h=a[e];if(!(h in c))break a;c=c[h]}a=a[a.length-1];e=c[a];b=b(e);b!=e&&null!=b&&p(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(l){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(e+(l||"")+"_"+h++,l)}.function c(l,m){this.g=l;p(this,"description",{configurable:!0,writable:!0,value:m})}.if(a)

                                                                                                                                                                                                                                Chrome Cache Entry: 933

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):214
                                                                                                                                                                                                                                Entropy (8bit):5.096829767629689
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4MJqgzQFqYgXT085Y:t47N9U/vmRYOF4Tm
                                                                                                                                                                                                                                MD5:BDC934DCE4645CFA785C33E037A00EFF
                                                                                                                                                                                                                                SHA1:87281A6721F6ACAE1DA886D68A9BA04F009831DC
                                                                                                                                                                                                                                SHA-256:09C41C2AC9873188C095279472467BE0EB4166C5E22AE52BA04E937AC94FC203
                                                                                                                                                                                                                                SHA-512:74331EE305E92CC3BF172624469D9789BE82A2D48EB1791210931C125F40298EC96F3875D8CFD25E8F323071D041930CDD1BADFD0AF9B032D290B56E3E838048
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/subscriptions/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M10 18v-6l5 3-5 3zm7-15H7v1h10V3zm3 3H4v1h16V6zm2 3H2v12h20V9zM3 10h18v10H3V10z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 934

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):114292
                                                                                                                                                                                                                                Entropy (8bit):5.5528653263166285
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:BfaN1hvawAB3MAYcKh+CY0YcQ1rFPyY5c/F1FRLf+aD3Wp94yXCQC4NIT3PTtSGa:BfaNbAB3IacQLiPFRLf+e3g9bXcAITk
                                                                                                                                                                                                                                MD5:EA5144AB403234BE650A76530D1CB29D
                                                                                                                                                                                                                                SHA1:67DEE97C0AE2F912CE9F4CB1ADB9181857A01DF3
                                                                                                                                                                                                                                SHA-256:6EA25790432AA3DF786FF6518EAE8400D61081EE2A2206082C24B3FC6D4705DF
                                                                                                                                                                                                                                SHA-512:74998F4A928418639BCC2C4EE5BE2DABDC01D5D4C5E3C69BA606E9A0757D173EC542BBD3BD2CFC31CBC17057B421773778997A80F1C4925022DEE0A0B4CA0241
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var Atb=_.y("ltDFwf");var AU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.$r(this).fc(function(){this.Fa.length&&(this.Fa.forEach(this.f9,this),this.Fa=[]);this.La&&(this.La=!1,_.Bq(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.Bq(this.mb,"transform","scaleX("+this.ja+")"));_.$q(b,"B6Vhqe",this.Ca);_.$q(b,"D6TUi",this.ta);_.$q(b,"juhVM",this.Ma);_.$q(b,"qdulke",this.aa)}).build();this.ea();_.zg&&_.$r(this).fc(function(){b.ob("ieri7c")}).Ae().build()();_.ez(this.oa().el(),this.Sa.bind(this))};_.B(AU,_.J);AU.Ba=_.J.Ba;.AU.prototype.Sa=function(a,b){Btb(

                                                                                                                                                                                                                                Chrome Cache Entry: 935

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 25 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):804
                                                                                                                                                                                                                                Entropy (8bit):5.9272601627884605
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:6v/7ykl/f/je0aVMrCwGPlc+Zen0JTSdoc9EdyBw3w6xuS8SNGqsaNg:onBaVHwGPlxen0NSucwXoSJN+8g
                                                                                                                                                                                                                                MD5:C156C107AE735C5F3813220235E0D11E
                                                                                                                                                                                                                                SHA1:F655A14E144551432AAE9BA0A7FE0E237A65AE51
                                                                                                                                                                                                                                SHA-256:D75C74B337113A0C65EBFF05ED63A487A0E158BC7246B987A28943667DF46C5B
                                                                                                                                                                                                                                SHA-512:A2729CA423327C0855BDC68374AE0EA6B211043EBD39A63B7248BF4E288B9641BF3F827EA01C4FB0444BCFBC68B6E06B51EEDE746668F14D4F7225B9B941CC81
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/q8Uic1K195T.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR.......@......,n....PLTEGpL....................................................................................................................................................................................................................................................^.g...QtRNS..d....(..........B...:.>...0..XVLJ|<.t....Rv....6D4n.......@x.8...h..\... .NJ.!V....IDATx^...@...4Q@.yf.:1l.9.../3.M...l..U.#........$?...........kI]|.$GI&#.{.R..../d7$..x!.c..X..\B>...x./..X..[....SQ!@c\%..RNr"rrv.!.b.%.......j...n,...u..*).y.]."..r.b..P...B.FU....`.........s...,..y..(.3...!$.. ....F.(.a...g.?R.F.B:....$C...t...........\..N....c..2..`..VH.1..mF>.....t.L.MxDY....Y..U.6.$...O.(.....U.)/.e.mk..$.^.N....-........:.U.d.7...yp_i...Y.z....t..=...f#Q....IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 936

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (709)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):3940
                                                                                                                                                                                                                                Entropy (8bit):5.103789867340088
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:KOR0kZK2BOR0kFrVkzzQxPYqX9q2lqAEY8HIXOYl6nMLycA1:FVmRqb7Njnsq
                                                                                                                                                                                                                                MD5:B0941BDD004E6C28F0CB205A95383022
                                                                                                                                                                                                                                SHA1:00FDEBE11357C6D69F38060AEA80C20B59E70377
                                                                                                                                                                                                                                SHA-256:0B7A91A97CF2FC8E74DEE6DA487581FF30FC5A484F030937E7EF4B4DE5AB4771
                                                                                                                                                                                                                                SHA-512:8079DE1D8C68AFCD21C2E06CB73572E9A617AB949AD9CAD22C9D12CF495D852CFDF7114080DC29F211C9960084F9A2A053FA53D2B2938C3467D0FA958336C8DD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yz/r/EZcFVpNhrUH.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometVideoHomeCatalogRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7332904830081595"}),null);.__d("CometVideoHomeCatalogRootQuery$Parameters",["CometVideoHomeCatalogRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometVideoHomeCatalogRootQuery_facebookRelayOperation"),metadata:{},name:"CometVideoHomeCatalogRootQuery",operationKind:"query",text:null,providedVariables:{__relay_internal__pv__StoriesRingrelayprovider:b("StoriesRing.relayprovider")}}};e.exports=a}),null);.__d("CometVideoHomeLiveRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="8274177899276614"}),null);.__d("CometVideoHomeLiveRootQuery$Parameters",["CometVideoHomeLiveRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometVideoHomeLiveRootQuery_facebookRelay

                                                                                                                                                                                                                                Chrome Cache Entry: 937

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 144 x 144, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):729
                                                                                                                                                                                                                                Entropy (8bit):7.234317148111566
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:6v/753iqqqqqqqqqqqqqq8apRTOe/RlzL064pdYTCrQQXHth6oHS0iwPuOb254iu:u3iqqqqqqqqqqqqqq8sdOe/RBL0NpdAM
                                                                                                                                                                                                                                MD5:F6E5A9215D13C4AEF31D125532228410
                                                                                                                                                                                                                                SHA1:CF2AA58CCDDC2B414CAD4A28394EF66CD2AE9FFF
                                                                                                                                                                                                                                SHA-256:8639DB0DBAA462E7BC11D7884C3A6CB84275DC988811CD2BFAF5CF2E65BC0FE0
                                                                                                                                                                                                                                SHA-512:2468FD00812806E44A2EB1AEF7F408D643DCFBEE655802E69B62DCE21F84AE3EC6E50F6612F332CB35FF53EC4792104C27DFD6DA36327FBEADE9D7FABC7C3412
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR...................cPLTE.......................................................PP.......... ..........@@....``.00.......pp........tRNS.@0 p.....P..`....Y.....IDATx...Ub.0.EQC.(.2..W9%......Y...eg.1..c.1H.C..$z.. ?......M.*.....R.. +.}.}t_0.m#.....T.....gje.9.7u..%.7...y..Q.D.Z..^vW..x......(.G..!R^..)..j4P...B.(H...igA(j.d...?...,.....DM8ZZ........:8...uCG.'...P....\....=..\<.\......=c.......H..`...+YD_.H...6vHa ur.....&.vJ.@.R.p..Ni.@.)..i......#.vJ.@.)...tJ......+..*.....-.S#...u.....}-.\.N..{.....m._.A.."n)..l...a...CmzV.ma....-D..K.....3...x...VH.i...V.2..u2..).J..cU4.....VX......\BC.`...V..:.(:.Y.(..h.O.\..dcC.Q..:..~Lm..&..{v]z0....9=....-/.O.g.1..c.1D..b..;...F....IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 938

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):332
                                                                                                                                                                                                                                Entropy (8bit):4.296126422761529
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4FCvslQHcUiC7Q3ajuWskpwpWvWuMUMU2ldUiiW8kWuMUMUy:t4noU/vmRUslQ8+QKjupkpwpWvWuMUMk
                                                                                                                                                                                                                                MD5:F94123242618D16B950113BD6F22229D
                                                                                                                                                                                                                                SHA1:28B2E7A4ADB970446E442AE187E07328A68C1687
                                                                                                                                                                                                                                SHA-256:EC4C1E58EBA5A80E78C1B52486930F60634B4940322F230C236ABDCFD9F92DEC
                                                                                                                                                                                                                                SHA-512:E54B679A15465BEF172F1C364E34337B0C97D92C0F6C444253C8B69CD7147FD728DFEB1CDFA0DB64F0C13DC04999FB7CCE3C6CF49E77B4D1BA50798D9EDB3D94
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/overflow_horizontal/v4/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M7.5 12c0 .83-.67 1.5-1.5 1.5s-1.5-.67-1.5-1.5.67-1.5 1.5-1.5 1.5.67 1.5 1.5zm4.5-1.5c-.83 0-1.5.67-1.5 1.5s.67 1.5 1.5 1.5 1.5-.67 1.5-1.5-.67-1.5-1.5-1.5zm6 0c-.83 0-1.5.67-1.5 1.5s.67 1.5 1.5 1.5 1.5-.67 1.5-1.5-.67-1.5-1.5-1.5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 939

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):146
                                                                                                                                                                                                                                Entropy (8bit):4.927838870881226
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPPQGZYurgvCo0/:tI9mc4slhohC/vmI4PPQG7rQCz
                                                                                                                                                                                                                                MD5:F00EABC2D958B20D27018698E9EE9D5A
                                                                                                                                                                                                                                SHA1:F1924FD47C49C7B40C3AC7B983137345C7D36D4F
                                                                                                                                                                                                                                SHA-256:36EDBAF2D04F3475DE1BA1B3EEADDCA06F232CA0B35AF734A218A8974B9F0D9A
                                                                                                                                                                                                                                SHA-512:4532BE68AF977C96DF2A768C2059827142A8F0773F2010CBF160B9F81B2AEEEBD635AFC2092DBA38CF355B0912DEF6DD51E601FE6112EE944BE28A122FD4B60E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/bars_3/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 7H3V5h18v2zm0 4H3v2h18v-2zm0 6H3v2h18v-2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 940

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):193
                                                                                                                                                                                                                                Entropy (8bit):4.760511517259426
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRviTOnQFOaZ0mbtUUWcFtTcFM4UXo:tI9mc4slhohC/vmVR6q8ZvNbfQfirc
                                                                                                                                                                                                                                MD5:9C452955A4281F736C8786F3C0876419
                                                                                                                                                                                                                                SHA1:104D443B65C15A1CA934FA449520DC81D3C067DF
                                                                                                                                                                                                                                SHA-256:5968B4C826F14A991A83B0FF27573BD4A20FD5BB16F79140D399C2E7413BED10
                                                                                                                                                                                                                                SHA-512:F66BB34FA7FDAFBF4516105B2AA65315BF6836A71EB98043872E454988A2B17CF7F62254E234C7F07FC282C8926E690388F7F65F186823FD8478D7902ABC7B65
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/arrow_down/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.65,11.65 12,18.29 12,4 11,4 11,18.29 4.35,11.65 3.65,12.35 11.5,20.21 19.35,12.35"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 941

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):327
                                                                                                                                                                                                                                Entropy (8bit):4.811141801937251
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4T7DmkHIMdZ72LYMFFMnxS1wTVcOLSvb:t47N9U/vmRT7Ck/dZ7BceS1McOLmb
                                                                                                                                                                                                                                MD5:9F7171D7377F96797D3AA80C2A82E49F
                                                                                                                                                                                                                                SHA1:E20980E2B3558839803623702CB63E594FD1EE48
                                                                                                                                                                                                                                SHA-256:D7718E518AF1A501D91B19F97DD5CD28740782852C3FB0BE5B5F1A6855C26F4F
                                                                                                                                                                                                                                SHA-512:9931C4904654C1BA487B71BB301FAC4C5F477845043B20A8705045FBAA3325A9907BCDF928B613B8B80B10E1D0AA81281473693066B056206C03C59FAD703932
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/search/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m20.87 20.17-5.59-5.59C16.35 13.35 17 11.75 17 10c0-3.87-3.13-7-7-7s-7 3.13-7 7 3.13 7 7 7c1.75 0 3.35-.65 4.58-1.71l5.59 5.59.7-.71zM10 16c-3.31 0-6-2.69-6-6s2.69-6 6-6 6 2.69 6 6-2.69 6-6 6z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 942

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (16331)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):738838
                                                                                                                                                                                                                                Entropy (8bit):5.72730112663479
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:ak162hzLiYeWJrJdH+ArOzIzLu9D4foBC1QVziBTJIK5+MHJw:akvtL48dtoBXVzixZpw
                                                                                                                                                                                                                                MD5:967CA4800E9DA13F9B910A870450F28E
                                                                                                                                                                                                                                SHA1:799A227041FB696A1465AA8EF41A7C88156D0C4C
                                                                                                                                                                                                                                SHA-256:DD7169B02CC269030C9B3D95DC0B83F01234A6431886269EC2447EBD7C43F792
                                                                                                                                                                                                                                SHA-512:7ECF38D4245E8D908605F0AD4F895F6A53C02405F68E9E7C313A930ACBD0575BBB2A0F7661BDFA6FFBCA1D73940995F11176A143729E231B25135A350024A6C9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.J6zlSvuPGsg.es5.O/ck=boq-identity.AccountsSignInUi.y688-Pa0BpE.L.B1.O/am=P2CJhmMBEISZlnP-nnFyGAAAAAAAAAAArAHs/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFQ8tmzv79x_nJGIapLTY1tp-HlWA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:yt7X5e;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                                                                                Preview:"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

                                                                                                                                                                                                                                Chrome Cache Entry: 943

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):287
                                                                                                                                                                                                                                Entropy (8bit):4.942964715795682
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4z7yg0AiICpOTRKOFI38:t47N9U/vmRTDiI6mKOGM
                                                                                                                                                                                                                                MD5:1B72B0A3A3280DBE3DF3FB5DF68F90E7
                                                                                                                                                                                                                                SHA1:4F79E7A51FF1920839B106DC9848BB7BE3702445
                                                                                                                                                                                                                                SHA-256:781BA2DA6DA2698EE6727A646CC2B903A848EDCF729376419007185023E4A0F0
                                                                                                                                                                                                                                SHA-512:32257B5EE24DFCA90170D4AF48F2C3091EE83277F0F584B4CB46D4290BF6BF4FAE6FEB0D803D6A8B35EEE69E8F292EABE8C3632EAF782B07A8572D1C32BDCC2E
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/lightbulb/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4-1.72-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 15.54 4 12.96 4 10c0-4.42 3.58-8 8-8s8 3.58 8 8z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 944

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):146
                                                                                                                                                                                                                                Entropy (8bit):4.938964132950675
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPKlhQtNNUunhjQAZi:tI9mc4slhohC/vmI4PKlGtNNUunJQ8i
                                                                                                                                                                                                                                MD5:0BB6E79FC4160D867A915A7D17A564FC
                                                                                                                                                                                                                                SHA1:E91CB173C9EEDDBFB2E61674DB09618A2479A053
                                                                                                                                                                                                                                SHA-256:DD08185E1339EA9B3EEA5B27FC3401E2171CE008523F8038B6B08681B4E05906
                                                                                                                                                                                                                                SHA-512:E1CB076164D3013612B36B41EAA43839A463C75104A85262CCC73B250ADEF1EC88D04D2A8F65D99D7EB89D4229022ECB4D3E370EE8BAC272426288A6F68C30F6
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/bars_3/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 6H3V5h18v1zm0 5H3v1h18v-1zm0 6H3v1h18v-1z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 945

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):293
                                                                                                                                                                                                                                Entropy (8bit):4.8755880591325855
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4VJD2zPdqUQx+dfYLnIsy2RRWdxWqOQF:t47N9U/vmRf2bQxC6Is/7WdQqOQF
                                                                                                                                                                                                                                MD5:4881148D1D44126355C7CC134FD58441
                                                                                                                                                                                                                                SHA1:DF5775C8A3DA221FAD474807432534FA6CB5C1E5
                                                                                                                                                                                                                                SHA-256:57678BA3491574C18E14F5B0CF26215F1233BAACD2373A10A8F7C58A4D5DE65E
                                                                                                                                                                                                                                SHA-512:3CD013A210871E199F5BB68B10072BFA92FCB8648D3CFAB5D47889006ADE956D0F6FB9501AEF1326780EBA47B99F95023CDC0EEEB5093A1788EE9D730A5B64CB
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/audio/v5/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-1.79 4-4V8h6V4h-7zM9 19c-1.66 0-3-1.34-3-3s1.34-3 3-3 3 1.34 3 3-1.34 3-3 3zm9-12h-5V5h5v2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 946

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (58866)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):121373
                                                                                                                                                                                                                                Entropy (8bit):5.175781132651112
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:sLQpmW+m/KTYGu9AoaI/mQVzm75W8Zcz834SS40FGXUQvqO4pxuor3lQNO301J8d:ZI2eIgRhGQLv90/I9aCIqYtpp
                                                                                                                                                                                                                                MD5:51A93812AF114DD8902597F09089FC4B
                                                                                                                                                                                                                                SHA1:EC670CCE0D590B144B66D6CA2BF3B9035197655C
                                                                                                                                                                                                                                SHA-256:0E130A5E0B4D2DE21225B3085724A442F1038865EC311BCE53993C96581425B0
                                                                                                                                                                                                                                SHA-512:941E433E83C971B414D6DFBF39221D06C45AA86A8F1E8E49A768E5CAAE115D8D93E3DC4B8BB87890AFF0330263120E4AB26FD38ABF0E836DB90940C10BAC1058
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3iKvn4/y8/l/en_US/08tvGtKV3n4.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometUFICommentListRendererForCommentsAPITahoe_renderer$normalization.graphql",["CometTextWithEntitiesRelay_textWithEntities$normalization.graphql"],(function(a,aa,b,c,d,e){"use strict";a=function(){var a={alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},b={alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},c={kind:"Variable",name:"location",variableName:"feedLocation"},d={kind:"Variable",name:"use_default_actor",variableName:"useDefaultActor"},e={alias:null,args:[c,d],kind:"ScalarField",name:"can_viewer_comment",storageKey:null},f=[d],g={kind:"TypeDiscriminator",abstractKey:"__isActor"},h={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null},i={kind:"Variable",name:"scale",variableName:"scale"},j=[{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null}],k={alias:"profile_picture_depth_0",args:[{kind:"Literal",name:"height",value:32},i,{kind:"Literal",name:"width",value:32}],concreteType:"Ima

                                                                                                                                                                                                                                Chrome Cache Entry: 947

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):114247
                                                                                                                                                                                                                                Entropy (8bit):5.544641603898549
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:phAG62BDU8LQ5LK+I3cJUmYMWqdYyUpVh:vAd4UuQ5LK+I3cJxYMFdYL
                                                                                                                                                                                                                                MD5:8C532C1B272F9FBC389D7057F53FF028
                                                                                                                                                                                                                                SHA1:9ABF44513BD132FCC623C1C7E16440FF36A8E865
                                                                                                                                                                                                                                SHA-256:A1AF49D5C704C39091894150E9D3005454915DD88E1C482AD1CFC3FC4C9F0C6C
                                                                                                                                                                                                                                SHA-512:BE5EA13ADA16191A029B2631B3472ADA1968902BC9DE9E7340597256EA8B6F52582E78D455787371BFA24B630ED9C021BBBC1DD45ED052DE82D7E9B21C71AFBE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.J6zlSvuPGsg.es5.O/ck=boq-identity.AccountsSignInUi.y688-Pa0BpE.L.B1.O/am=P2CJhmMBEISZlnP-nnFyGAAAAAAAAAAArAHs/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlFQ8tmzv79x_nJGIapLTY1tp-HlWA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:yt7X5e;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var hub=_.y("ltDFwf");var tU=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.xs(this).hc(function(){this.Fa.length&&(this.Fa.forEach(this.a9,this),this.Fa=[]);this.La&&(this.La=!1,_.Zq(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.Zq(this.mb,"transform","scaleX("+this.ja+")"));_.xr(b,"B6Vhqe",this.Ca);_.xr(b,"D6TUi",this.ta);_.xr(b,"juhVM",this.Ma);_.xr(b,"qdulke",this.aa)}).build();this.ea();_.Yg&&_.xs(this).hc(function(){b.ob("ieri7c")}).Ae().build()();_.cA(this.oa().el(),this.Sa.bind(this))};_.A(tU,_.J);tU.Ba=_.J.Ba;.tU.prototype.Sa=function(a,b){iub(

                                                                                                                                                                                                                                Chrome Cache Entry: 948

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (1631)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):38674
                                                                                                                                                                                                                                Entropy (8bit):5.373344735979869
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:AOZQqlnxITA3+sypwDMBub/6rur81gE0idWSBiHLztbyHgNkmtCgs+FwtNmle:efY+3g/br8qaWSBiHLRGHEbtCgKJ
                                                                                                                                                                                                                                MD5:9FB0BDB3A292F495914A785280685816
                                                                                                                                                                                                                                SHA1:2FBAC1566F42B41D336C3CEF46085A8ABA5291F4
                                                                                                                                                                                                                                SHA-256:8B94EC92B902A78BB5DCF8A9A5CF00B3F693738608FE110FF77A2E90FA62AA09
                                                                                                                                                                                                                                SHA-512:94E76518978E828E0EAA8B95C807E55DBF4E0EBA201FF5057906482AD5F57D2D2A6BA98F0EE16476688E3B5013525D06EAED692C6B795DAAE635F67B8CD100F7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.moa=function(a){var b=0,c;for(c in a)b++;return b};_.noa=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ka(a)||"string"===typeof a?a.length:_.moa(a)};_.vn=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map||"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ka(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.yb(a)};._.ooa=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg||"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ka(a)||"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.zb(a)}}};.var poa,soa,roa,qoa,Ln,Nn,Eoa,voa,xoa,woa,Aoa,yoa;poa=function(a,b,c){if(b)re

                                                                                                                                                                                                                                Chrome Cache Entry: 949

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):216
                                                                                                                                                                                                                                Entropy (8bit):4.800786010781648
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4TK4G2aCM0xt0WGSSJhEi:t4noU/vmRTKd2aCJiWGXEi
                                                                                                                                                                                                                                MD5:4769BF33E9F7764A9E55468B4B2FDD43
                                                                                                                                                                                                                                SHA1:018175AA909257C549153A1488B9C7FFFDEDA23E
                                                                                                                                                                                                                                SHA-256:53A433282E4E3F47144F41EAA4143F35763DB4616DF7791008A1AF78D32C975A
                                                                                                                                                                                                                                SHA-512:C78FA4DF431A81B903586FCA21B3315E781AE374B1443147EDAE2F961CBEB4A021F2BF363F39516380D596C3C448B9350D8FCE8A3A2C2CC1B28ED0FF11D26FCD
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/clock/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm2.97 14.95L10 13.87V7h2v5.76l4.03 2.49-1.06 1.7z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 950

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):398
                                                                                                                                                                                                                                Entropy (8bit):4.820547366953078
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRTDiI6mKOG7bTJ1XUfCRimfDqQehW:t4jU/v0rdGHTJCfCw+qi
                                                                                                                                                                                                                                MD5:2A0EC6EB2D5A6F6DEF85A2B9A667C42F
                                                                                                                                                                                                                                SHA1:08BA82555D8CA056757BEAC3F8B443A1F60C6061
                                                                                                                                                                                                                                SHA-256:85357D329507B0542A21870A328E20F77E6E991BC97D86EC0ACD2521A3C12332
                                                                                                                                                                                                                                SHA-512:60AD37CE0204D2F8C60E8F91405E97913E6481E09B4AFF28809573420B988E5AEAB5D77E6B55C8CFAE38D2EA0B228AE7A2EF2CF47FD2B461996B894834BFE9C9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/lightbulb/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M16 21h-2.28c-.35.6-.98 1-1.72 1s-1.38-.4-1.72-1H8v-1h8v1zm4-11c0 2.96-1.61 5.54-4 6.92V19H8v-2.08C5.61 15.54 4 12.96 4 10c0-4.42 3.58-8 8-8s8 3.58 8 8zm-5 8v-1.66l.5-.29C17.66 14.8 19 12.48 19 10c0-3.86-3.14-7-7-7s-7 3.14-7 7c0 2.48 1.34 4.8 3.5 6.06l.5.28V18h6z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 951

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x367, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):20062
                                                                                                                                                                                                                                Entropy (8bit):7.96610905174521
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:ngyF8aAt7iD+0bthsnVNCU07vS5KV+UiuNtCefiWhW4kP5QFekQH:n0eZfANuV79dcP5QFekW
                                                                                                                                                                                                                                MD5:CDFD9861FD3098A9C6DDFA3DE781E081
                                                                                                                                                                                                                                SHA1:2F28C3D3919241EC46BD653FB5016FEAE7BBC3D0
                                                                                                                                                                                                                                SHA-256:800EB33D7F3CF2DECD33A1B1D119380BDFD6CDD092F9E931AB4604CD43C6B0C2
                                                                                                                                                                                                                                SHA-512:A0FB1A066B99BEC06A1E7CE59D864929F36FBF9BAB04E47AF25B27CEAFFF4B41E8585207FB10B972C2102A059B9E4ADEA14802CABEA0FF060D86C24F3D251501
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/419886462_293687526661423_1357454940886286652_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=6XKSXit_6JAAX_GlTnR&_nc_ht=scontent-lga3-2.xx&oh=00_AfCQj2W7zRgXFY4GhEe3JGBI5MkgOTlXE_9Ao-dJl_W7tg&oe=65DA7732
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000053060000390f00008810000019120000711f0000492f00005b300000e63100008f3300005e4e0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......o....".............................................................................)......h?.P....p......$,.....+.;.......tN.E3.7..,.+.A........@..#$...2..A...X........=<.........<G.]..Z.t/._.......$...n...9..7.w...Q{..Jm...T..'.b...y...c^......."Q..8y.3..&h..N..<.T.p'....i%.jD....S.l.zK{..HH.s..e..J..I.FGr..Z**...n~..H......e...R...C+..BT7..<.Q5...N.WG..w'..w1....a.....-&`w.....*...JIl...t.vk.|.8w"wB..u.~.i.K.wr...:.....y..-#.;.(..*.A.......'>...1.....`..{".s.7&.s.0.r.uQ..7'9.eA.w.wp/'.Z..5^..M.R._..W[u6..Z...n...I{.*.. .........zwy.......L.....^....F..._K/gi....2.i......H..u(.-.V.p....h.$..X..ezvb~..L....w..yN......*-..l.E[iJ(.&^Y.......Mb...Hb..Z..2...}..:.//>...8

                                                                                                                                                                                                                                Chrome Cache Entry: 952

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1742
                                                                                                                                                                                                                                Entropy (8bit):7.115734652582993
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:gqj0eOGAc1spsFHMTbms6Qiv1YUH4G56nDvG/Pu/Uyd/ZYQZs0j4VYShXHcWd:g60eOViWsEiy1Y/PcUOZPUx9
                                                                                                                                                                                                                                MD5:EDFF32053EC9EE7E93F83BDB4BC58EC8
                                                                                                                                                                                                                                SHA1:85917802268112B14381C0D9E0FA23BCB46662DC
                                                                                                                                                                                                                                SHA-256:A5C86285DCD8BFEE31816376042FE7612C498CB080C34F55D5A7D9D04B155252
                                                                                                                                                                                                                                SHA-512:048916223A35B1AD1DBAB6D121DBEB06BCAC9275D26CBF9399767161DD7560918F585CF7D554DDBDADF30523348986A4559675058E2A22F6A232A1D5B5C64757
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/414964561_969817307833794_6134986783555283737_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=B4Bc-D4t8uIAX-c3f8G&_nc_ht=scontent-lga3-2.xx&oh=00_AfDIZWOr-XFMmlNgAdatLunJij0twY6z3vPaGtNrs06Wfw&oe=65D9F4A2
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000e701000084020000d502000035030000da030000a8040000e30400003705000091050000ce060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."...............................................................................V....;......4..rii..z.p1e..P.Jy..$.9.h....9.dL..9[..r.4.#`..(.-....#.........................!23..$1B..........k....c..@..".*s...Y@J.Y;.#.1..%J.)..M....GI"...T^..3#.d.'..%9....z7....Y...L.l;...2.!.%..#. .....).m<..[vW... ........................!12..Q........?..4...Et...J.uB....vb..,..%...S.+.....!......................!..2Q.1AC........?..+[.._e:..Q6..-....:.....7..H...9....{K.yK.Q.....&.....................1...!2AQa"q.#.R........?...h.(..fN.a...i..A.ln.*...8.:e.Gs(.....%.t.^_.....n.V.....&..5.t.Y*..d....P.....<*..(.M.L..!f.f.Q).yQ...on{ .......#....................!1AQaq...............?!...a

                                                                                                                                                                                                                                Chrome Cache Entry: 953

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (19300)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):278309
                                                                                                                                                                                                                                Entropy (8bit):5.409028772835641
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:fPHaQFjs1PlJ/yfJJubY9OD47YzD4HEBuP2IUeOkFCbPIO6I3uclVuYgyi3i8/Kj:m8xm7AP2Iqn/UmxgcSDOOa
                                                                                                                                                                                                                                MD5:340868CF2C840DE168D77463396D60D3
                                                                                                                                                                                                                                SHA1:4F1EFABA3EE4B1E1A26DEE1D178953BFB9188F5C
                                                                                                                                                                                                                                SHA-256:808EC6221BA222DA52AED8B83EA836EF99036392321892D31723BD5EAEC2700D
                                                                                                                                                                                                                                SHA-512:B78CFD4383440A54855A3F19573EBF18C16BDD3997BCB1B126D772E1B16947E6053382B6FE56F8195E023CAF7FCCD23EDC08340B9A137F6596ECD6C827E1ECB9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/yW/r/-xtNSS8Cn-Q.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis||typeof self!=="undefined"&&self||typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)||d.set(e,new Map());var f=d.get(e);f.has(b)||f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

                                                                                                                                                                                                                                Chrome Cache Entry: 954

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1971
                                                                                                                                                                                                                                Entropy (8bit):4.140265923170004
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:4uxgftjRvYQn94Cz5pdVw8jV/cu745MJzis0rR+ToGq/SJKF:aR5pPvtc2fd0YT+
                                                                                                                                                                                                                                MD5:8F64411A9AC7F40E18967F620AE1B546
                                                                                                                                                                                                                                SHA1:4C3FCE32CE99FAACEA1BADF35BE7091BD2F09384
                                                                                                                                                                                                                                SHA-256:B77B4C9A17FB16DDADEC307F40FE8B37F806D80E97E3F8854142CDA91662708B
                                                                                                                                                                                                                                SHA-512:3DE4780539E5C9850987401436A8F5D16177393C1AF930B01B7E9987CE2CB875ABD2490116DE0B6597C2A1B0D0D11E7AC872B652E5D8EF3B84C23146FAA0FA16
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_kids_round/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path fill="#FF0000" d="M21.39,13.19c0-0.08,0-0.15,0-0.22c-0.01-0.86-0.5-5-0.78-5.74c-0.32-0.85-0.76-1.5-1.31-1.91 c-0.9-0.67-1.66-0.82-2.6-0.84l-0.02,0c-0.4,0-3.01,0.32-5.2,0.62C9.28,5.4,6.53,5.8,5.88,6.04c-0.9,0.33-1.62,0.77-2.19,1.33 c-1.05,1.04-1.18,2.11-1.04,3.51c0.1,1.09,0.69,5.37,1.02,6.35c0.45,1.32,1.33,2.12,2.47,2.24c0.28,0.03,0.55,0.05,0.82,0.05 c1,0,1.8-0.21,2.72-0.46c1.45-0.39,3.25-0.87,6.97-0.87l0.09,0h0.02c0.91,0,3.14-0.2,4.16-2.07C21.44,15.12,21.41,13.91,21.39,13.19 z"></path>. <path fill="#000" d="M21.99,13.26c0-0.08,0-0.16-0.01-0.24c-0.01-0.92-0.54-5.32-0.83-6.11c-0.34-0.91-0.81-1.59-1.4-2.03 C18.81,4.17,17.99,4.02,17,4l-0.02,0c-0.43,0-3.21,0.34-5.54,0.66c-2.33,0.32-5.25,0.75-5.95,1C4.53,6.01,3.76,6.48,3.16,7.08 c-1.12,1.1-1.25,2.25-1.11,3.74c0.11,1.16,0.73,5.71,1.08,6.75c0.48,1.41,1.41,2.25,2.63,2.38C6.06,19.98,6.34,20,6.63,20 c1.07,0,1.91-0.23,2.89-0.49c1.54-0.41,3.46-0.93,7.41-0.93l0.1,0h0.02c0.97,0,3.34-0.21,4.42-2.2 C22.

                                                                                                                                                                                                                                Chrome Cache Entry: 955

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):191
                                                                                                                                                                                                                                Entropy (8bit):4.705262579447954
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHlbRviScJUkRUWJDUU1V0QLEjz5UFDUl:tI9mc4slhohC/vmVR6SWJDNejF2il
                                                                                                                                                                                                                                MD5:28B7D5722D774748EB3BEE51D246A9A8
                                                                                                                                                                                                                                SHA1:B61B3FA044EA865243E2FF195A81AF1027A9F152
                                                                                                                                                                                                                                SHA-256:9B70EAE3BBA1AFC60819D43E37AF558FAB2D1C429DD940DCAB4B35E23BD51989
                                                                                                                                                                                                                                SHA-512:9E8D26D7EA3B6ED05348EB75555FDCB001AECC24AB8516AE8058C3B7FA6B791CAB056A31FBEAFEC18C9E97FB39657B07EA7ABE3E3347B9C9D86FC18AF4943796
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/arrow_down/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><polygon points="18.79,11.29 13,17.09 13,4 11,4 11,17.09 5.21,11.29 3.79,12.71 12,20.91 20.21,12.71"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 956

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (4264), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):4264
                                                                                                                                                                                                                                Entropy (8bit):5.023352101476255
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:cMR3GqZFZlZuAwkQ29BR6WtFfH/2Ff8FfSiY3hUgxJu8OJ/:cxC3wkQ29XtEmgiUhUgxJu8OJ/
                                                                                                                                                                                                                                MD5:9DEAE13C40798DFCA19BD14ED7039D60
                                                                                                                                                                                                                                SHA1:4BA302A1435B094031E4F2E1BCE1B6198F0CF825
                                                                                                                                                                                                                                SHA-256:CDAC5527DC3C1A9F38C6B00086B2A10B9E7EAA1E062314E548C1FA602D17BBBD
                                                                                                                                                                                                                                SHA-512:95B093D926535FA9454E3776A3E219B61502CE67AA2E659175AE879133DD35A6EFA1BFDBE5B6D3E3DD8BA1F0663892B44FD6F21BE17FEFA9725A234DFF3C5D0C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/cssbin/www-main-desktop-home-page-skeleton.css
                                                                                                                                                                                                                                Preview:#home-page-skeleton{position:relative;z-index:0;pointer-events:none;min-width:0;width:100%;opacity:1;margin:56px 0 0;display:-webkit-box;display:-webkit-flex;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;flex-direction:row}#home-page-skeleton.hidden:not(.layered){opacity:0}#guide-skeleton{display:none;background-color:#fff;width:240px;-webkit-flex-shrink:0;flex-shrink:0;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-flex-direction:column;flex-direction:column}#guide-skeleton.collapsed{width:72px}#guide-skeleton .guide-item-ghost{padding:10px;width:100%}#guide-skeleton .guide-ghost{padding:10px 30px;display:-webkit-box;display:-webkit-flex;display:flex}#guide-skeleton .guide-ghost-icon{height:40px;width:40px;min-width:40px;margin-right:15px;border-radius:50%;background-color:hsl(0,0%,100%)}#guide-skeleton .guide-ghost-text{height:36px;width:100%;border-radius:8px;background-color:hsl(0,0%,100%)}@media (min-width:792p

                                                                                                                                                                                                                                Chrome Cache Entry: 957

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (776)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1480
                                                                                                                                                                                                                                Entropy (8bit):5.278661843249328
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:kMYD7xb4Uu0UIqraN3OYfl/HTn93EyNPrIH6iQG7ALbDs3dEGbwc0GbgjUTOuhZg:o7xbm09Awn9Es66nG7API3dEGbwc0Gb0
                                                                                                                                                                                                                                MD5:B1E42198FB893A628628BCFDB3667B1F
                                                                                                                                                                                                                                SHA1:A115D5B91E02912CC6099FFD6B6F5CBCE6F19EC7
                                                                                                                                                                                                                                SHA-256:263E701257ED8F7A63E265CF0F906020AF51E8552732D23F11276DB5428B08DD
                                                                                                                                                                                                                                SHA-512:EC2AE05CCF97D6F21268ADA5C21F90D6BCD0F6F8E9E7E3D5264A866589673BB3EE88B2724209BC4D608B7BCE2EDDCCCE8DBCAA2AA8B30F265FDC4D0CEDD79566
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJlmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlHX7bqWFdDNmEBWjhJk6Qjl972aUA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("kMFpHd");._.lUa=new _.qk(_.Qk);._.l();._.k("bm51tf");.var oUa=!!(_.Kda[0]>>18&1);var qUa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Fa=e;this.aa=0;this.da=pUa(this)},rUa=function(a){var b={};_.Na(a.tN(),function(e){b[e]=!0});var c=a.gN(),d=a.mN();return new qUa(a.WJ(),1E3*c.aa(),a.EM(),1E3*d.aa(),b)},pUa=function(a){return Math.random()*Math.min(a.ta*Math.pow(a.ja,a.aa),a.Ca)},qE=function(a,b){return a.aa>=a.ea?!1:null!=b?!!a.Fa[b]:!0};var rE=function(a){_.I.call(this,a.Ha);this.Bc=null;this.ea=a.Ea.vQ;this.ja=a.Ea.metadata;a=a.Ea.F$;this.da=a.ea.bind(a)};_.B(rE,_.I);rE.Oa=_.I.Oa;rE.Ba=function(){return{Ea:{vQ:_.mUa,metadata:_.lUa,F$:_.fUa}}};rE.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Bd()))return _.al(a);var c=this.ea.aa;return(c=c?rUa(c):null)&&qE(c)?_.Csa(a,sUa(this,a,b,c)):_.al(a)};.var sUa=function(a,b,c,d){return c.then(function(e){

                                                                                                                                                                                                                                Chrome Cache Entry: 958

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):531
                                                                                                                                                                                                                                Entropy (8bit):4.517890434004929
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4tM65EVlUbal0YClBze4gKCqRaMcmt+BOgyy9e5PhwWU:t4tMMbS0TBAMdc1QgcdrU
                                                                                                                                                                                                                                MD5:D8AB2A29ED285F79AF11A250D2536BC1
                                                                                                                                                                                                                                SHA1:B394B72270ECA95336C5780E1F97C0CAD051C0FF
                                                                                                                                                                                                                                SHA-256:AAAEF8F774A256E546C1178D91EBBA27FA0F7A7420D7E54DCC4F26D6DD7AB31A
                                                                                                                                                                                                                                SHA-512:3F376435B591FCB848D4D259A0DA5BAE15EB8583572C00C6E3041DDB64C1756E48A333EB6144042A45D23E2A45DB623CD78DB5467579051CA674F93C8964FCE2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-comment/v2/32px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M5.5 3C4.11929 3 3 4.11929 3 5.5V21.5C3 22.8807 4.11929 24 5.5 24H22.5L26.7474 28.5741C27.5513 29.4399 29 28.871 29 27.6895V24V5.5C29 4.11929 27.8807 3 26.5 3H5.5ZM8 10.5C8 9.67157 8.67157 9 9.5 9H22.5C23.3284 9 24 9.67157 24 10.5C24 11.3284 23.3284 12 22.5 12H9.5C8.67157 12 8 11.3284 8 10.5ZM8 16.5C8 15.6716 8.67157 15 9.5 15H18.5C19.3284 15 20 15.6716 20 16.5C20 17.3284 19.3284 18 18.5 18H9.5C8.67157 18 8 17.3284 8 16.5Z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 959

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):187
                                                                                                                                                                                                                                Entropy (8bit):5.110752654085156
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHAquqFbV9jXReHFAATcvXjXRHRcBHoNcHVaocoaQgeFOK/:tI9mc4slhohgqWHiA4vmI4VPgq
                                                                                                                                                                                                                                MD5:590C4B291CE0B9AD72E436BD0777D562
                                                                                                                                                                                                                                SHA1:974DC251B395357A38A0EC06CB87C28F70A23CB1
                                                                                                                                                                                                                                SHA-256:F40804CDE31FC6CE2B19B2E4DE7189916146031A5D7958B4512D30751B767D00
                                                                                                                                                                                                                                SHA-512:5DE6F1C10AF2C9EAD02B9DCA07FC4B23E0B34872CB1904FE2EED57BD2C4739CAC0A5FEE24401B457F146F5A6D43DE807E1D44DD4D33AA3B8BBA33B107428AF77
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/play_arrow/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" style="enable-background:new 0 0 24 24;" viewBox="0 0 24 24" width="24"><path d="M9 5.87 18.2 12 9 18.13V5.87M8 4v16l12-8L8 4z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 960

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1150
                                                                                                                                                                                                                                Entropy (8bit):1.6001495726289154
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:XFeeeQL5555555555dWr555555555555b5555r555555b555Lr555553r555Lh5k:X2uD
                                                                                                                                                                                                                                MD5:F2A495D85735B9A0AC65DEB19C129985
                                                                                                                                                                                                                                SHA1:F2E22853E5DA3E1017D5E1E319EEEFE4F622E8C8
                                                                                                                                                                                                                                SHA-256:8BB1D0FA43A17436D59DD546F6F74C76DC44735DEF7522C22D8031166DB8911D
                                                                                                                                                                                                                                SHA-512:6CA6A89DE3FA98CA1EFCF0B19B8A80420E023F38ED00F4496DC0F821CEA23D24FB0992CEE58C6D089F093FDEFCA42B60BB3A0A0B16C97B9862D75B269AE8463B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/img/favicon.ico
                                                                                                                                                                                                                                Preview:............ .h.......(....... ..... ........................................................................................................................................................................@...@...p.......................@...@...................`...................................................`.......0...........................................................0...P...........................................................`................................PP...................................................................... .............................................................. ......................................................@@.................................P...........................................................`...0...........................................................0.......`...................................................`...................@...@...........................@...@......................................................

                                                                                                                                                                                                                                Chrome Cache Entry: 961

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (6544)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):30894
                                                                                                                                                                                                                                Entropy (8bit):5.582255413109731
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:dlMmkEeGSQnBx355zXv2Vpfd2A2Yjdw8w5hdvWewVebB:HVnPBh55zf2l2Yv54
                                                                                                                                                                                                                                MD5:BD73519A54802D4CB27DB39E57A51A3C
                                                                                                                                                                                                                                SHA1:35D2BD2BF01344DD2965AAF129F8D01BD846F1E3
                                                                                                                                                                                                                                SHA-256:4F2B758D75B3C766B75625157FE35E5F8F965E8A94F31955628593E769E4FAC4
                                                                                                                                                                                                                                SHA-512:0E317B384EC69D09AB96CCCCF3D0AA2F5F23C62108B05551626DF21318F035AE415493D652488C0C1A26D6418A8618CB50A708696A3A181BB7EAE1ED41D37C8F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3i0Wo4/yG/l/en_US/-boqNkzBTGm.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometContextualLayer.react",["BaseContextualLayer.react","react","useCometVisualChangeTracker","useMergeRefs"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||d("react");function a(a,b){var d=c("useCometVisualChangeTracker")();b=c("useMergeRefs")(b,d);return i.jsx(c("BaseContextualLayer.react"),babelHelpers["extends"]({},a,{ref:b}))}a.displayName=a.name+" [from "+f.id+"]";b=i.forwardRef(a);g["default"]=b}),98);.__d("CometTypeaheadProgressGlimmer.react",["CometProgressRingIndeterminate.react","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||d("react");function a(){return i.jsx("div",{className:"x6s0dn4 x78zum5 x1iyjqo2 xdd8jsf xl56j7k",children:i.jsx(c("CometProgressRingIndeterminate.react"),{color:"disabled",size:24})})}a.displayName=a.name+" [from "+f.id+"]";g["default"]=a}),98);.__d("CometTypeaheadViewItem.react",["CometPressable.react","CometRow.react","CometRowItem.react","emptyFunction","react","stylex"],(function(a,b,c,d,e,f,g){"use strict";var h

                                                                                                                                                                                                                                Chrome Cache Entry: 962

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):192
                                                                                                                                                                                                                                Entropy (8bit):5.1052862366626295
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHEkRY4zf9UJtTzWNRI:tI9mc4slhLJ9hC/vmI4zRqj/CIIHZY
                                                                                                                                                                                                                                MD5:326BF908127D15320C80C12962A91DCD
                                                                                                                                                                                                                                SHA1:D346CFA4AE456C3E070206472F06E90A9DAA8C25
                                                                                                                                                                                                                                SHA-256:97DC7B49E38E2084B1877557AF54EBA95BF7FAF06980E0DCCDCA2EAD81E35B60
                                                                                                                                                                                                                                SHA-512:E4835907B72B75C09F32416911A4B3535791B54C6BDD0BFA9C0A48399A8E4930CDBD0B32FD13A67002F49F99199FBE358D5B4B89E4609C837E73799FF0D46F08
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/library/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M4 20h14v1H3V6h1v14zM21 3v15H6V3h15zm-4 7.5L11 7v7l6-3.5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 963

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):207
                                                                                                                                                                                                                                Entropy (8bit):5.099700989024115
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4u2U6PTkY5fUgNOJNu:t47N9U/vmR0kTkYZUg2M
                                                                                                                                                                                                                                MD5:D9BB191D7185DB63EC946298DE7F9AF9
                                                                                                                                                                                                                                SHA1:CDE1E715177A55F8F7C9CE0BB1766481EF215D8A
                                                                                                                                                                                                                                SHA-256:40829C1F6F101B7122AB0D9EDC7A4EDB6368448259A74831C2FAD26D865DD90F
                                                                                                                                                                                                                                SHA-512:7B8B57273161CA8EC550E7C04AAFA34A8C48CE66FBFB5123C48F84AE4A5C9B43C5820EC5D00E62B12D3AFF946ACCC4F1501132FDB034A9E39F83B18E6A7CDAB0
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/library/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m11 7 6 3.5-6 3.5V7zm7 13H4V6H3v15h15v-1zm3-2H6V3h15v15zM7 17h13V4H7v13z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 964

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:HTML document, ASCII text, with very long lines (682)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):4119
                                                                                                                                                                                                                                Entropy (8bit):5.363860210804462
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:GkBsIzf6Aj6TQTdkvEc2K7UrtNoyd+ypYokBnz8oLw:3BHzn+Wm97UToyd+ypYokDc
                                                                                                                                                                                                                                MD5:B60A1BABBA7EDBA6C5A9FC4836A079C6
                                                                                                                                                                                                                                SHA1:082278E6B6E8A2F53237EE992E77FE45F8764957
                                                                                                                                                                                                                                SHA-256:A925BAF5E1E6227CE778335AE876AD0B2C0A46AF791E2FE0BE7D9548015BBD82
                                                                                                                                                                                                                                SHA-512:975738EE48432A77B3423E4BE71EE3FAEF65CF03EFA95A786357438132ECE6942ACF1163DB3A1513515A8617807D5C21DA44CB510E32DCA941927F5C369388B9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
                                                                                                                                                                                                                                Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.uf(_.hna);._.k("sOXFj");.var Rq=function(a){_.I.call(this,a.Ha)};_.B(Rq,_.I);Rq.Oa=_.I.Oa;Rq.Ba=_.I.Ba;Rq.prototype.aa=function(a){return a()};_.Lq(_.gna,Rq);._.l();._.k("oGtAuc");._.Gsa=new _.qk(_.hna);._.l();._.k("q0xTif");.var Cta=function(a){var b=function(d){_.bm(d)&&(_.bm(d).uc=null,_.er(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},qr=function(a){_.np.call(this,a.Ha);this.Ra=this.dom=null;if(this.Zh()){var b=_.sk(this.Cf(),[_.Uk,_.Tk]);b=_.wh([b[_.Uk],b[_.Tk]]).then(function(c){this.Ra=c[0];this.dom=c[1]},null,this);_.Dq(this,b)}this.Ma=a.nh.U7};_.B(qr,_.np);qr.Ba=function(){return{nh:{U7:function(){return _.ff(this)}}}};qr.prototype.getContext=function(a){return this.Ma.getContext(a)};.qr.prototype.getData=function(a){return this.Ma.getData(a)};qr.protot

                                                                                                                                                                                                                                Chrome Cache Entry: 965

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (776)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1480
                                                                                                                                                                                                                                Entropy (8bit):5.278661843249328
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:kMYD7xb4Uu0UIqraN3OYfl/HTn93EyNPrIH6iQG7ALbDs3dEGbwc0GbgjUTOuhZg:o7xbm09Awn9Es66nG7API3dEGbwc0Gb0
                                                                                                                                                                                                                                MD5:B1E42198FB893A628628BCFDB3667B1F
                                                                                                                                                                                                                                SHA1:A115D5B91E02912CC6099FFD6B6F5CBCE6F19EC7
                                                                                                                                                                                                                                SHA-256:263E701257ED8F7A63E265CF0F906020AF51E8552732D23F11276DB5428B08DD
                                                                                                                                                                                                                                SHA-512:EC2AE05CCF97D6F21268ADA5C21F90D6BCD0F6F8E9E7E3D5264A866589673BB3EE88B2724209BC4D608B7BCE2EDDCCCE8DBCAA2AA8B30F265FDC4D0CEDD79566
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/ck=boq-identity.AccountsSignInUi.NrxHlLi3bwM.L.B1.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlG2bCygi1DFAdwYKgmmvgAMIJrIdw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("kMFpHd");._.lUa=new _.qk(_.Qk);._.l();._.k("bm51tf");.var oUa=!!(_.Kda[0]>>18&1);var qUa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Fa=e;this.aa=0;this.da=pUa(this)},rUa=function(a){var b={};_.Na(a.tN(),function(e){b[e]=!0});var c=a.gN(),d=a.mN();return new qUa(a.WJ(),1E3*c.aa(),a.EM(),1E3*d.aa(),b)},pUa=function(a){return Math.random()*Math.min(a.ta*Math.pow(a.ja,a.aa),a.Ca)},qE=function(a,b){return a.aa>=a.ea?!1:null!=b?!!a.Fa[b]:!0};var rE=function(a){_.I.call(this,a.Ha);this.Bc=null;this.ea=a.Ea.vQ;this.ja=a.Ea.metadata;a=a.Ea.F$;this.da=a.ea.bind(a)};_.B(rE,_.I);rE.Oa=_.I.Oa;rE.Ba=function(){return{Ea:{vQ:_.mUa,metadata:_.lUa,F$:_.fUa}}};rE.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Bd()))return _.al(a);var c=this.ea.aa;return(c=c?rUa(c):null)&&qE(c)?_.Csa(a,sUa(this,a,b,c)):_.al(a)};.var sUa=function(a,b,c,d){return c.then(function(e){

                                                                                                                                                                                                                                Chrome Cache Entry: 966

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):726
                                                                                                                                                                                                                                Entropy (8bit):4.339020219837034
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t4tM65hacbIQEJzqgnuTx9DcwBCkrcE+DDuqE3kjZRpQNtdhlwcf9iSBcG7BihbX:t4tMMt9EgFEFu+eq7fpQNtdMcf9iSqku
                                                                                                                                                                                                                                MD5:1B8EC16A3060F8866E64FCDC09FF7185
                                                                                                                                                                                                                                SHA1:B5E017E0D46F2DB0FC18A5E74F740D69FEED0372
                                                                                                                                                                                                                                SHA-256:4E4AAE10A6FD5B8F86E1565507983459C3D0F474313547C9DAB176F83261A523
                                                                                                                                                                                                                                SHA-512:07CD2A5466B397E612EB7A9827646BF0606031ECAE1771DCD93360BFF0F14477ABCD0F70B215C21879C9C5BA5E64BA9114CB036D7D401BE873DE1F84CC40B888
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/shorts-like/v2/32px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M25.8411 11.9977C26.6778 11.9977 27.4597 12.414 27.9268 13.1082C28.6951 14.2498 28.6876 15.745 27.908 16.8789L27.1796 17.9383L27.8546 19.5037C28.257 20.4368 28.1597 21.5102 27.596 22.3558L26.4999 24V25.9977C26.4999 27.1023 25.6044 27.9977 24.4999 27.9977L11.9999 27.9976C10.8953 27.9976 9.99987 27.1022 9.99987 25.9976V12.8264C9.99987 11.9927 10.2604 11.1799 10.7449 10.5015L15.8632 3.33586C16.0776 3.03569 16.4721 2.92531 16.8112 3.07062C18.5762 3.82706 19.5347 5.74955 19.0766 7.6144L17.9999 11.9976L25.8411 11.9977ZM5 13.4999C3.89543 13.4999 3 14.3954 3 15.4999V25.9999C3 27.1045 3.89543 27.9999 5 27.9999H8V13.4999H5Z"></path></svg>.

                                                                                                                                                                                                                                Chrome Cache Entry: 967

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                Entropy (8bit):4.979692330240301
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHELK9hrqgrNI2fSb8:tI9mc4slhLJ9hC/vmI42shrlrNI26b8
                                                                                                                                                                                                                                MD5:BE80E385F4A43E39B89AA315010E5AFC
                                                                                                                                                                                                                                SHA1:C48EF18CD412B3F8E96C8A9F10418C10BDC01557
                                                                                                                                                                                                                                SHA-256:6EC0894C8BEEEE04A033DFFBE2E54E1BC3C6C8CE4A75738F4E5A13EBA571B2D9
                                                                                                                                                                                                                                SHA-512:73FBC9F5EC906A6F95A2BCF002A021DA499AEB87023A77345416CA04FFA8148C776E90ADC0CE9F45FBF093F2D6506D0803ED5E73DC46A3DC747FCF71CFEB96DC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/message_bubble_alert/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M4 2v20l5-5h11V2H4zm9 12h-2v-2h2v2zm0-3h-2V5h2v6z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 968

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):183
                                                                                                                                                                                                                                Entropy (8bit):5.04119913967567
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHoNcHmAIb0WNUoOUGf7/:tI9mc4slhLJ9hC/vmI4mtb0PCGz
                                                                                                                                                                                                                                MD5:DB8E084413F0D763A3EFBF3573AFC33A
                                                                                                                                                                                                                                SHA1:FF8264FCAAC48F90B0CB74E09D65655EFE09488B
                                                                                                                                                                                                                                SHA-256:A058F9F44A83FDF8074494F9322A40EF1B6E159DBEEF1E30BDECCE736AFD1E2D
                                                                                                                                                                                                                                SHA-512:28A6102E54D20BBAE6D0A4D98971FE4170392A3354B55FD504C0DD1A0896CB5E786D85AFD64EA9EC308009795EB4C8392F2CE22CCD8A6DC4B84CEBFC4929CDEE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/my_videos/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m10 8 6 4-6 4V8zm11-5v18H3V3h18zm-1 1H4v16h16V4z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 969

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):220
                                                                                                                                                                                                                                Entropy (8bit):4.95427055782646
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4VJD2zPdqUQx+dt:t47N9U/vmRf2bQxS
                                                                                                                                                                                                                                MD5:64C5CFD76908E80E8D1C35BB65CF26CB
                                                                                                                                                                                                                                SHA1:DCDA22BE3CFBA2AF2C7CD98465F601E8B3C5888A
                                                                                                                                                                                                                                SHA-256:59BD8FAC9261910ADAE788A1BA4E550544F05A84312049D2C254FC37A7596CC1
                                                                                                                                                                                                                                SHA-512:37C54AF2F2D644BBA688775BC77FB0AED604F9ED4675FF89117A0AA264C62A0291AFC145A7D20C4C4D14F13E6C460CF6D39B1F925E442BD7A3A190BA77B98DE7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/audio/v5/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-1.79 4-4V8h6V4h-7z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 970

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):259889
                                                                                                                                                                                                                                Entropy (8bit):5.404210528859754
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6144:cBlJQj9MPzJWnodfkei/E+sPKqno7TMbyzb8f:eJQ0z95PKqno7Tw
                                                                                                                                                                                                                                MD5:9D0FC0EA580E0D6FB1F604E2EEF55C8D
                                                                                                                                                                                                                                SHA1:181C495A7BE7CE596332355DB28E16A3FDFD49B1
                                                                                                                                                                                                                                SHA-256:235852C8D371A9D2352C70B3D951B6C3E9A39F553A522EFC7A6649DF6FD6918C
                                                                                                                                                                                                                                SHA-512:13FF392BA3473D495E944AA3559F33A74FBC9EABF39A8CD152345DEEB76F39F36C1B0288BF949F79233B179DDB8D4EAA8B532A80DFB15F134FFA9E5C46189323
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.licdn.com/sc/h/9aqr8a0t3v3gde6w2txxdc9l9
                                                                                                                                                                                                                                Preview:!function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={i:r,l:!1,exports:{}};return e[r].call(i.exports,i,i.exports,n),i.l=!0,i.exports}n.m=e,n.c=t,n.d=function(e,t,r){n.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:r})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var r=Object.create(null);if(n.r(r),Object.defineProperty(r,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var i in e)n.d(r,i,function(t){return e[t]}.bind(null,i));return r},n.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return n.d(t,"a",t),t},n.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},n.p="",n(n.s=92)}([function(e,t,n){"use strict";n.d(t,"j",(function(){return a})),n.d(t,"x",(function(){re

                                                                                                                                                                                                                                Chrome Cache Entry: 971

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):374376
                                                                                                                                                                                                                                Entropy (8bit):5.207466711124167
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:1536:sMi8ZHMCbS/SgV9UI3ILJPptpJKztM6oyi+MOn4y2Ox5juDEnXrDJc7MsByZ54cf:sMi8ZiSggImSoyJufmJ3ckIoNN
                                                                                                                                                                                                                                MD5:101CE6BEC017FDEDA83AACA342362AAA
                                                                                                                                                                                                                                SHA1:3495E40A0E1427DFE2668D100B748E3B2BE51C13
                                                                                                                                                                                                                                SHA-256:52535A880872C1C5273500B7F045580DFFFB0FE2A02852223E9E63DB92D41CC3
                                                                                                                                                                                                                                SHA-512:50A83664F427CA8A742031F4B42566510BE0A1A3D1CF671701BF47C038D963126E61B7B995ED2760F1E031F96D6D60D5E4757FAC2E60F766E9D34C1A85D3BFF4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/player/5683fc5e/www-player.css
                                                                                                                                                                                                                                Preview:@charset "UTF-8";.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-font-smoothing:antialiased;-webkit-tap-highlight-color:rgba(0,0,0,0);touch-action:manipulation;-ms-high-contrast-adjust:none;forced-color-adjust:none}.html5-video-player:not(.ytp-transparent),.html5-video-player.unstarted-mode,.html5-video-player.ad-showing,.html5-video-player.ended-mode{background-color:#000}.ytp-big-mode{font-size:17px}.ytp-autohide{cursor:none}.html5-video-player a{color:inherit;text-decoration:none;-webkit-transition:color .1s cubic-bezier(0,0,.2,1);transition:color .1s cubic-bezier(0,0,.2,1);outline:0}.html5-video-player a:hover{color:#fff;-webkit-transition:color .1s cubic-bezier(.4,0,1,1);transition:color .1s cubic-bezier(.4,0,1,1)}.ytp-probably-keyboard-focus a:focus{-webkit-box-shadow:inset 0 0 0 2px rgba(27,1

                                                                                                                                                                                                                                Chrome Cache Entry: 972

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):21123
                                                                                                                                                                                                                                Entropy (8bit):7.966896575699838
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:ClUCHc0oN6VHOPbkowDWBvY0eKUgMOSO00s6/bMlaerJdQvr:Cyd0oN6lOPbkTDsvfe+MODnN/bZerJo
                                                                                                                                                                                                                                MD5:D0A0970D29AF305D4D11E05BA24C3E02
                                                                                                                                                                                                                                SHA1:6F8793F5CEC978FCDCCD8754875DEF10CFF84BB2
                                                                                                                                                                                                                                SHA-256:12DF618354A6A611CCF70F07F89DD394D3C7775E5C54A00E0D8DDF83115A0B86
                                                                                                                                                                                                                                SHA-512:AFC00CDC3FF0D376F84AA5BEE355ABF4C799CB47DCDF8FAABCB91328D10564C598B9F1C76089EBABFA1684455860090EADD4418D2BEB636C0406D3D87A3EA04A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426544426_2534620483377194_7705172159301659751_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=7jzCRbOhdz8AX8Kib4E&_nc_ht=scontent-lga3-2.xx&oh=00_AfDpWn4nFEl6KFBYTdOaiigGtf2Xq9ZNJQMvBeC41DelgA&oe=65DA73C3
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000034060000420f000049100000bb110000291c0000342e0000442f0000dd300000b032000083520000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................r.....E...H.....!.*......|..:..<....x..d:z...W-........%...r|l.$....p..K\it.....+={..3.....c_.X.`..`k...x.LT....W.... ..L...!..)...k_M]....P...v...t4..|.....;!...A....>.9B.U.h.sG/i<..gj...y..o..q..+62tQ.k.GF.}K...o<0...R..l..3.e.h..O...._5..e..^n.....].....h.x.........G..+bt....>.k.g.......*..{..u.\.^m.@Sh..l#.X.Rv&..u..KE..f.e6..R};.@...G1.gZ.!o.....x...^!......,1.)!....j.Q..J..w8..s./.MW..@...%LK.......|...hsmt...P...,m..c....L..........So5Z.?7..7....d.^..E\..=8.....p..`y".,BC.g..K...h..].t|..;...U.ETj.7iy..7gh.S.....B....(..!u..'F-B.izS^.?:..6..X........h...?..Q..-kJ..*.

                                                                                                                                                                                                                                Chrome Cache Entry: 973

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):335
                                                                                                                                                                                                                                Entropy (8bit):4.848782964528927
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4K+tlq2LwkzdO+iEuUDXpzBX6xjU5SWcYISJ2gLGpnQEVRp3:t4noU/vmRxxVzMHUFXMU5SWclS4AuQQv
                                                                                                                                                                                                                                MD5:9F4AFB8B5C116B8C96AD6A0BF69021DB
                                                                                                                                                                                                                                SHA1:DA12B34E4705D9875C8CC67EFE0058698E537A78
                                                                                                                                                                                                                                SHA-256:61B18613E4A65CB373AED90B59C16370DF577861FBA91C5029B2BFFE6E14EAEB
                                                                                                                                                                                                                                SHA-512:3839B172D4A4C0A1D07829DF590C8B3F780DCED47C3C17C79B2B07E71DA35CAED39338E4FDF5A7D6A38C327DB481CD7C41BC601EABB9E01F6FED5D02BE083FE2
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/trophy/v1/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 5V2H6v3H3v6l3.23 1.61c.7 2.5 2.97 4.34 5.69 4.38L8 19v3h8v-3l-3.92-2.01c2.72-.04 4.99-1.88 5.69-4.38L21 11V5h-3zM6 11.38l-2-1V6h2v5.38zM15 21H9v-1.39l3-1.54 3 1.54V21zm2-10c0 2.76-2.24 5-5 5s-5-2.24-5-5V3h10v8zm3-.62-2 1V6h2v4.38z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 974

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):7122
                                                                                                                                                                                                                                Entropy (8bit):7.871258322524097
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:CSCD1Ka5vYOrbUjwB0ho6Ds9HUqf9VSxUJ:ClsmUjwB0PQ9bfjrJ
                                                                                                                                                                                                                                MD5:BA4FC7360622DA29A9BB6A079C42433F
                                                                                                                                                                                                                                SHA1:156E6FD1B0F3811377253A347B9E57038FCF5681
                                                                                                                                                                                                                                SHA-256:2CCCEF76016D55851D5EBB3872AA101DF7772F6C3B753D66F2D6DE20CB401CD0
                                                                                                                                                                                                                                SHA-512:AAB5B1C50705860606904F5DEE1E4EE010769C6AFEA0B9EED9C319EC7D7BE2A1CD304CF867B799871D6FEB20A88D6E0905FB500413098D5DFD3A5C1D53432CC4
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/426626851_1050536366238159_6966000035968128461_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=R66jyteP_YoAX-mOaJF&_nc_ht=scontent-lga3-2.xx&oh=00_AfByD1viJ7XoQ3lMV0iufo-iD0n9BmqIg3Qhp2FQVjqvIw&oe=65DB1F12
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100002705000049080000c50800006a0900006f0b0000ff0f000011110000fc110000f8120000d21b0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................<..b...0..T.T..D6..*l...p . .T...$.SH.I$`.4Z..-..a..D1..... ..R5*......^.y. ......IRb$.SR.CH.#Kt..w4..@.&Z.J.%IR...3W".4/H..K8.%E..,..Q,...J.B.M.......X.)Ft..0....U...).............r..b.a#%J..T..T.c.....nD.j0.j...4..M .F....c.x...P.0..H..&..@ .....kW..%VJ.<..O.....t...H.D.%Ur.s.<f..V!...g-..y..L..L4.$.iH.*x|..:....*...,.c.}O.i..EP..V+K.....s.......1....I...]33............#h..U.U.m..T....vo...].e.z...b~.........:..p.}...Q%....+....w..,C.W.H...41..5...?...W...?..y.$.%...1.?>..l..7.n....x{.E.-zy#(..d...0...,......<.N5....'..N......|..x..z.GM.>.....=.t.}.~.....7.|C.\t.........Yt..

                                                                                                                                                                                                                                Chrome Cache Entry: 975

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2063
                                                                                                                                                                                                                                Entropy (8bit):7.311401152655177
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:evrxiWqyT2XUtiVYUXW69sgz8wyVJyGvzsQ7v4gjbJjxldTwOff9uL:evrJiVYUmIpz8wyVJd7v4wbJnduL
                                                                                                                                                                                                                                MD5:D1C07507F0478AFCF2048CA5CFA8DF8A
                                                                                                                                                                                                                                SHA1:0501333A139F37C7989B038FF9DB9E5F7C0A3E9B
                                                                                                                                                                                                                                SHA-256:7DC293DBAED3EEA5ED83CD12A38475EF7C9B6AE27623FD0259AF041BC07A689F
                                                                                                                                                                                                                                SHA-512:BE906ABFCC8A63328EC69C9C48D6C346C98A5FE8D7938655C4A57D2BFCA7ECC3B23F14EC22A6EFEE22F55FE1142C4548E82D306D42FE7D3AACA6D743AFDA899C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/308504404_387290806940494_150870101384029952_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=wtDvLE5PBs0AX-odxfq&_nc_ht=scontent-lga3-2.xx&oh=00_AfCo8jOnKvQ0hQXuPCdTZV6OYO2ILPI9tm_iGNWWGkQCnQ&oe=65DB1742
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM..........g..q23vDrsifgMTf9PIa3ea..(.bFBMD0a000a8701000001020000b40200001a03000082030000940400008e050000cd05000030060000910600000f080000...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................(E2..`.^..j.U..EEW^.......lU.S=....[._..]r.S.N..~..6...<....n8........"..........................!...3A..........)...)..^ ...}...k.a`....(.....H .F8..%|T.{;..8:K.Y........Nk......u&.....N.......W.......U^....6...{Z.....j.u....J...mt.#....$........................!1..A.3...........?...@...v...@.&.\....v...A..c...-.R..u6>..m...B......u...".......................1..!."2Aa........?..v.IRdY....<I.i.......x..A@C.i..)....My.._._............................!"1Q.Aa.2R. Bq..............?.%.wE.&.....K#..!..y..L..k...X..G..5. ..f.#7.<+....`..P.....g.2.XC..V.$...T%..'..ds..d.

                                                                                                                                                                                                                                Chrome Cache Entry: 976

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):45772
                                                                                                                                                                                                                                Entropy (8bit):7.995894939857093
                                                                                                                                                                                                                                Encrypted:true
                                                                                                                                                                                                                                SSDEEP:768:Y5kTdY9aW6/NjB3ADIhkALgFm+bRb8VeHyeAfboFaLTUdeco+hb8+pSulIp5vH:OkT66/NjFN6me8eSeAfboILTUAc78Xuu
                                                                                                                                                                                                                                MD5:84984FD3379398D5B84AB1F191584DE3
                                                                                                                                                                                                                                SHA1:E9346BD8A0CF998E96E19720E722BA3551FBAF4F
                                                                                                                                                                                                                                SHA-256:1EFEAE4BFF9D347B3473ADAA95FD0D6D1D7DFDE4CA800A31F41E5EC546280085
                                                                                                                                                                                                                                SHA-512:3F39F7A2511A7808591B774456C1507622EC82ED2FEBDC70A1CC52DD1958DF53B466264030966A023BA76C8256F1DF43002DB5E34FB291D6B02D4ACDCF1550E7
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i.ytimg.com/vi/jSDm9PYSAes/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLAOI0Rm7_Ry_AokEfJbO-fDEpRzZQ
                                                                                                                                                                                                                                Preview:RIFF...WEBPVP8 .....j...*....>Q".E#.!#.6..p..Fwk#t+r..y................./....g.N.t...y..s.....................~S.........G.G..................>........7.......?.?..1?.................8..=........-......]............o...s./.......~.?..f................_._...o.....r.x..?.._....o...?..5.y.K.+.O.~qj#.'..._.?n.....g.E...~0....A.z~...............G..^.....3.......O..._...i.?...?p.....n......._.L.....o...?....?....a.S...../..._..........._.g..t..o._..4.....UHs..>H.?.;...?(... ....Oa).paIZ..]g.H.gM,..7..j.T..9do>.79.l#l.z>.N...F.0.o@..\.....E.....S...r..rP'.v?....q.....a._.D.Jw....T..<?.)"X..Q...w...*.nf.I9..4*..U.......3.h..c......V..?...?..3_..m..>..;h.. ...".t...2.Z...)?.r....,.[.A..I@v.<B[G"{.........(.V...8x....V..k.m.....3.U`."`k*...z.:...'....b.`x5...S.9.....1>....'.a.... ^...G.....L$.2.<..0..7.k*Rfe0.B...$y.".&X..0B'.>...7.2EM.z...@.UX..Nd.ZU...X9......Y.y.....! M.5....D..:|y.......S......$.."..lb[....2..!.s.zk}q.......'..]....'x..|....{.N.R.j.

                                                                                                                                                                                                                                Chrome Cache Entry: 977

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):561
                                                                                                                                                                                                                                Entropy (8bit):4.664076278294878
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRBoGaBoVOLgbvSFWeGzE+5OPiufVKJXbsUFSQiYHUloL:t4jU/vRGaBoc2SLX9fUb12NSL
                                                                                                                                                                                                                                MD5:627CBC730DA8617E4FDA79BB7FC35F2F
                                                                                                                                                                                                                                SHA1:C1CF15F3D7BD2AC64B329E353D26771F5C13FE77
                                                                                                                                                                                                                                SHA-256:817119ECC2BC54779A271A53B347E8AF33C2544934D642D7877E99267BB0745B
                                                                                                                                                                                                                                SHA-512:FB2299DC0272ECE197FE5656C0ABF1E6CF96F5D25F3D135D2DCE3D7CF50C189BC0C9C73D1B042020DB47B2FD680230C61F9A6D599D385CEFFAC87F20CEB69555
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/thumb_up/v17/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M18.77,11h-4.23l1.52-4.94C16.38,5.03,15.54,4,14.38,4c-0.58,0-1.14,0.24-1.52,0.65L7,11H3v10h4h1h9.43 c1.06,0,1.98-0.67,2.19-1.61l1.34-6C21.23,12.15,20.18,11,18.77,11z M7,20H4v-8h3V20z M19.98,13.17l-1.34,6 C18.54,19.65,18.03,20,17.43,20H8v-8.61l5.6-6.06C13.79,5.12,14.08,5,14.38,5c0.26,0,0.5,0.11,0.63,0.3 c0.07,0.1,0.15,0.26,0.09,0.47l-1.52,4.94L13.18,12h1.35h4.23c0.41,0,0.8,0.17,1.03,0.46C19.92,12.61,20.05,12.86,19.98,13.17z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 978

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):241
                                                                                                                                                                                                                                Entropy (8bit):5.137838894912298
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4hNpDCbNBdANjcmgTLMAqY:t47N9U/vmRhNpCsYNLzqY
                                                                                                                                                                                                                                MD5:2BEBB6EA2A23E97C81427106D9722D4E
                                                                                                                                                                                                                                SHA1:38DC371BFBF0DCA768A702E89ED00877F34621E7
                                                                                                                                                                                                                                SHA-256:4C4B6AEA58201D13608EEB52B960E052E9C7D677B7281CAF0E6B713A3E2F223B
                                                                                                                                                                                                                                SHA-512:F4BE381ECF6616EB82FC4B139BC67E6EEE70B1B71581150FF4E69E09E0B6EDA8729536413CDAAB38642F0616944089F96A3DA8369B56870D1118E91B67C2FEC9
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/news/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M3 3.03V21h14l4-4V3.03H3zM6 6h12v2H6V6zm7 9v-2h5v2h-5zm0-3v-2h5v2h-5zm-1 6H6v-8h6v8zm4-2h3.99L16 19.99V16z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 979

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):182
                                                                                                                                                                                                                                Entropy (8bit):4.923041841279974
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHaxhTIQfaaiBFbCcD8o+fmQGq18i:tI9mc4slhohC/vmI4OhEQfR6Fb3Y1OQV
                                                                                                                                                                                                                                MD5:D6F15B1444CE6B4DBC711AC9E9041F17
                                                                                                                                                                                                                                SHA1:98D8A4EAB8E132C5894592992F532CF36D71810D
                                                                                                                                                                                                                                SHA-256:2BE645A9C201E31B43E28FD5541E36B73175D503362ACBA96CF578B95DB8DD8A
                                                                                                                                                                                                                                SHA-512:89F41624C92CB68B716287E74ADD7DEEF7BD67E8FB68BBF7DF93BB84AE1478248CDFC35C26F45A0A6DE347808E9E6431CA771EC9A18E0FF6869843D66B2B4E77
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/download/v9/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18 18v2H6v-2h12zm-.6-6.3L16 10.3l-3 2.9V4h-2v9.2l-3-2.9-1.4 1.4 5.4 5.4 5.4-5.4z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 980

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):363
                                                                                                                                                                                                                                Entropy (8bit):4.49126552549198
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4CCUljullQ5dUiC7KITuMUxldUiiiC1ofuMUxldUiiiC17:t47N9U/vmRXKjullQ5d+puMUxldbfuMh
                                                                                                                                                                                                                                MD5:82A60FADA6F7957329BEEE85E0453CAF
                                                                                                                                                                                                                                SHA1:6882C6B5F04787D57F3B59C1D1559623BC40E146
                                                                                                                                                                                                                                SHA-256:98901DDFF67E245769A3E1F47ABA0210653F817436CE288646FC0BB88E859CFA
                                                                                                                                                                                                                                SHA-512:646BE4874078FB5B9072DF552DA8CF0A1E5533D1B65392E06008676D8B06CA3E5EAFAC14C89BB580E0A7EAAEE94B3EC0825174328C3B30FC92D66730FBAD373F
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_outline/overflow_vertical/v10/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 16.5c.83 0 1.5.67 1.5 1.5s-.67 1.5-1.5 1.5-1.5-.67-1.5-1.5.67-1.5 1.5-1.5zM10.5 12c0 .83.67 1.5 1.5 1.5s1.5-.67 1.5-1.5-.67-1.5-1.5-1.5-1.5.67-1.5 1.5zm0-6c0 .83.67 1.5 1.5 1.5s1.5-.67 1.5-1.5-.67-1.5-1.5-1.5-1.5.67-1.5 1.5z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 981

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (7990)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):465346
                                                                                                                                                                                                                                Entropy (8bit):5.568829571605224
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:GQELY2kiAGRx0KDCJcrjrMwmvsPJ80cFcelRDKRsHu8aP9jpgc7S/i18EtJZGwSa:yK6elhkss9jOc7S618YZGxrpsU6Frb3r
                                                                                                                                                                                                                                MD5:19CDE8C7D278D8D2399B3082E08AB79F
                                                                                                                                                                                                                                SHA1:087AC4B875035E81E374F7A560935BFD1856D5DB
                                                                                                                                                                                                                                SHA-256:B405B1012AFB798C8242CC121DC2E228342E5803B5084C2B5BE42CF1AF85F735
                                                                                                                                                                                                                                SHA-512:1D5BC365F37041CBF159034EC292704986DB0288ED2B6CE836F706E0D92B899A101C155C8D3FFEE38722541ED3058591FBCE8189F54247C70E4CE07440DD471C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3ifrz4/yh/l/en_US/yLGZ8RCWXS5.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                                                                                Preview:;/*FB_PKG_DELIM*/..__d("CometBatchNotificationsStateChangeSubscription_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6546596222061607"}),null);.__d("CometBatchNotificationsStateChangeSubscription.graphql",["CometBatchNotificationsStateChangeSubscription_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a=function(){var a={defaultValue:null,kind:"LocalArgument",name:"environment"},c={defaultValue:null,kind:"LocalArgument",name:"input"},d=[{alias:null,args:[{kind:"Variable",name:"data",variableName:"input"}],concreteType:"BatchNotificationStateChangeSubscribeResponsePayload",kind:"LinkedField",name:"batch_notification_state_change_subscribe",plural:!1,selections:[{alias:null,args:null,concreteType:"Notification",kind:"LinkedField",name:"aggregated_notifications",plural:!0,selections:[{alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"seen_state",storageKey:null}],storageKey:null},{alias:null,args:nu

                                                                                                                                                                                                                                Chrome Cache Entry: 982

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):181
                                                                                                                                                                                                                                Entropy (8bit):5.0971144323973805
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHeQR+Hmy7NdURsoDCb:tI9mc4slhLJ9hC/vm+Qqmy7NdcE
                                                                                                                                                                                                                                MD5:FE331A9DBB967C0CF9B8F9393194706D
                                                                                                                                                                                                                                SHA1:AD46D5C48638D094B7CB6065748F2F0DC13379D3
                                                                                                                                                                                                                                SHA-256:7BB86F0FED70C3026F3D41D1ED0ADC304A4EBA489901226658C65A9244A4E22A
                                                                                                                                                                                                                                SHA-512:E67196D4A808B2E82EBEFD6922A5822F9FC11C9F030B7E0C75D079A700339D1D0300B12DADEA7DFF9833BB27FCCFA1C4E026783091484FD6E6F7B1078251D057
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/flag/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M14 3H5v18h1v-9h6.6l.4 2h7V5h-5.6L14 3z"/></g></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 983

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):669
                                                                                                                                                                                                                                Entropy (8bit):4.392258836691397
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmnqMVveSuXqVytjpdIYnX1Gcekt+7lUJJsUGF7pmAqjb6mUz:t4jU/vfSundBX8wt+osujsz
                                                                                                                                                                                                                                MD5:2FC469BBFA86F0452A71C0841D764880
                                                                                                                                                                                                                                SHA1:ED84D8A8D42D04498588E03C666FADED521DF292
                                                                                                                                                                                                                                SHA-256:27C9E5810D545D84F4968F1DDED0421E78F2B3C28C6C89DEF47D57E079AB1E90
                                                                                                                                                                                                                                SHA-512:30C0A81DF9B6BE79670031F934D364575E1A94ED4BB120032687794B15A48EA6C6130F1BFD29D71A094B35DF2FE4E8FDF470F87D0B2140641168CEF3B90DC04C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/radar_live/v6/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M14 12c0 1.1-.9 2-2 2s-2-.9-2-2 .9-2 2-2 2 .9 2 2zM6.36 6.33 4.95 4.92C3.13 6.73 2 9.24 2 12s1.13 5.27 2.95 7.08l1.41-1.41C4.9 16.22 4 14.21 4 12s.9-4.22 2.36-5.67zm12.69-1.41-1.41 1.41C19.1 7.78 20 9.79 20 12s-.9 4.22-2.36 5.67l1.41 1.41C20.87 17.27 22 14.76 22 12s-1.13-5.27-2.95-7.08zM9.19 9.16 7.77 7.75C6.68 8.83 6 10.34 6 12s.68 3.17 1.77 4.25l1.41-1.41C8.46 14.11 8 13.11 8 12s.46-2.11 1.19-2.84zm7.04-1.41-1.41 1.41C15.54 9.89 16 10.89 16 12s-.46 2.11-1.19 2.84l1.41 1.41C17.32 15.17 18 13.66 18 12s-.68-3.17-1.77-4.25z"/></g></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 984

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 480x360, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):6167
                                                                                                                                                                                                                                Entropy (8bit):7.068151611244259
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:JpqSyLG+nUx+aq7LY4/s2N9UKMjvArxtU:/qSE+nq7Lf/xxMjYrxtU
                                                                                                                                                                                                                                MD5:40796F6C997B2C9AB2B97EB4E4411F4D
                                                                                                                                                                                                                                SHA1:A176DB0AEF50E7D6C3AA1819757BAEC4B28E24FC
                                                                                                                                                                                                                                SHA-256:5021934EDCFB438D084B2442AE77482CC81A9DD5C2EEEDD5925F04033E0236CB
                                                                                                                                                                                                                                SHA-512:91429B60D6466982E723ECE5DCA2712E9FD711C3930D53084D893AFEB9CDA09DBFCE09E4ED434850F09047148CB1D25A48CBDA09EC4B11ED5FFFDD8CACD933FF
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://i2.ytimg.com/vi/qOFGfnaxvDQ/0.jpg
                                                                                                                                                                                                                                Preview:......JFIF.............................!*%$""$/)0'.5825/:0=E?PB5>O=52EaEKVV]\[5EemeXmPY[W......./../]?2?WWWWWZW[WWWW]WWWWWWWWWW]W]]WWWWWWWWWWWWW]WWWWWWWWW......h....".......................................G.........................!.1A.Qaq."....#2BR......3Sb....$5crs......4C.............................#.......................!1.AQ"2a..............?..............o..%..................................00..@.........................@....................................j.........................2P............................................................................................................................o..%......8.T(.J.L#k.7..x.=...(...U{....~..i]....tK../.b\...8..%.................................................................i....%HG..~.>W....J..p~Wz.x..)........Ug7...N)}...>.E>q..w.....q..wUc8.8.I....)..F.V:S.N.k....s@9.................................................................0.......W:.,MJ.N:W......f...I.U..../.5.....5.JMEE.Rv.OSo..g.7...TSri[L.

                                                                                                                                                                                                                                Chrome Cache Entry: 985

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (2036)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):39877
                                                                                                                                                                                                                                Entropy (8bit):5.396884329936008
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:768:uwoR/ZrQgcREIb+9KiiqR12623vlpOeO/hpoLpRX:uz+gcRhQRIb9AP/hps
                                                                                                                                                                                                                                MD5:EB4FBC0E01EB4A539A6BC202AFD4C644
                                                                                                                                                                                                                                SHA1:1798B96F94E4461C211A1E5118994F6E0DFD53BE
                                                                                                                                                                                                                                SHA-256:ACAE96AA93E083C150D041E2F01185932E5AACD71E4B433CD165DD41AA97103A
                                                                                                                                                                                                                                SHA-512:B608780ED207A42DBE9DEEE88400A6D9462029A653CEC42323490B7023F210E99FB38BE5574A451F069EEB5A7F8125505989B331A2243C56D1F2C84A74A2B371
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/spf.vflset/spf.js
                                                                                                                                                                                                                                Preview:(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof l&&l];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var da=ca(this);function ea(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.ea("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g){this.g=f;ba(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.protot

                                                                                                                                                                                                                                Chrome Cache Entry: 986

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 21 x 409, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):2540
                                                                                                                                                                                                                                Entropy (8bit):7.241602582463701
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:hjUR4TN+zzhq3Y40mP0VFx2teUFhZX3cUxadsKx6aBDLUSZ:V8cN93vQOeUFhZX3cJ/IaBDLzZ
                                                                                                                                                                                                                                MD5:617B29D87C8BE0A9E367320313656B2A
                                                                                                                                                                                                                                SHA1:46320109EDC1764CFBC60AD4F031E4018CF6ADEF
                                                                                                                                                                                                                                SHA-256:286E3110841E9FCE71D0E8CFCA1D1B7B0EDF781AF6D752ABF05F89AA6760EE79
                                                                                                                                                                                                                                SHA-512:42CEAF698DD7556BBA2BA11264B9923E66EBC514AF8554EBACF83391E7AA690E5DFAB2222872D40B61AE5FAF1500D22E6077808D0F5341088C70B36DEAA52C19
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/v3/y2/r/2UXBRrhCqJH.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR.............Q......PLTEGpL.............................................................................................................................................................................................................................................................................................................................................................................................*m.5....tRNS.Z.$........>.........t@...\...V..J..D..*........X(.f......|"<d..`.PN.2.,....T.4H........p.~r..F LB0....b.&j8^6..hn.x.:Rlv.z=......IDATx^...S.I.../.......B.$."....`L..6`p.a.n..~..M......U.[E..T...*.~.....P.....O%.!...B...Ib......;.)..].!.....Z..:.[....S..!....[...Z....zh........g.....@.d..@......-.X......d3...fJ.q..R.Q...2X...ze.V...,....c..U.O.U.GW.[.......o(.,...j@.h~._....L.*.......K...ou..{...s..9..0.O.......LYM........[.+.....@..ldJD..G...W..+..........s.5.^..DCE....:...n...l..]E..).R.... 4hkH....x.V~S<2.I..[./..=...V#G....3D.NT..D.

                                                                                                                                                                                                                                Chrome Cache Entry: 987

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):1843
                                                                                                                                                                                                                                Entropy (8bit):7.16303485779481
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:48:gVz+cfiWGG1/SYhzoVprvEafeUGdhTTWfF3sOUscuF:sz+coiSYaVpAYtGvUtsOUpq
                                                                                                                                                                                                                                MD5:91F70971324606E02E1F9278425159FD
                                                                                                                                                                                                                                SHA1:C20E49943F53585AD81A00BAC5BE7ECBC1A30924
                                                                                                                                                                                                                                SHA-256:57F2425566392C95180FB63DADCF3B00BBE87421D41CCA38AF82AE13BD2312CB
                                                                                                                                                                                                                                SHA-512:B4334199F3EAC777EB5901D8ACD41CC43AA75C314843846C70DDEF5B95125632F20C8E083C9AF820944E50A0975A68F86D5E279334C2CDC5C8A3687AF96F65DC
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t39.30808-1/362674575_109953428857037_934482552453905860_n.jpg?stp=c0.0.50.50a_cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=XbfeXopRIY8AX9Io_wV&_nc_ht=scontent-lga3-2.xx&oh=00_AfB5I_x0tS8ciFf62bmr6PmzJt9I6Rlio16um0qZBcq2uw&oe=65D97103
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6c010000dc01000080020000be0200000903000000040000ec0400002405000068050000ad05000033070000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."............................................................................$n.F...g...!]4.4.i .ZbS.(.<KS....]_{.#..Z.4e........BA....\..... ........................1.!.#3..........]MZ............q...K2f{....2..E..M.&..1"=..|....M#e.i.q.....d.4..\.a&....-K?"O.O..t%...y...._F.F......W.;..~...Ws............................!. 1A........?.E.....x.(.... .....>t..........................!. 1A........?..$..3.$I^.2d[~.Q......,.......................!1A."BQa.R.23bq.r..........?.Q...i..p.j..G..1/.'V|...Sn.wNg5 .p.E......+..q8...O.].....,4.ns..kj...u......s..k......6..j.d0.h..mo..G..oKs.c..(.....Q.rT.N0.'8......$5..w..0cG.....d8._t&@13*-...I....Z..C...?...>.....M.G......%...........

                                                                                                                                                                                                                                Chrome Cache Entry: 988

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):373
                                                                                                                                                                                                                                Entropy (8bit):4.744613189871505
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhLJ9hC/vmI4aC/foF8mw4U0bW5RJDURmodj6iiYp1GTDWbyLsji:t47N9U/vmRtnY8/4U0wRJIAoZ6iiYp1U
                                                                                                                                                                                                                                MD5:25F33107B1ABE585D6667013A5EE0156
                                                                                                                                                                                                                                SHA1:08CA62806C11E78AFA36E27F4334593A721CDA78
                                                                                                                                                                                                                                SHA-256:D00CC0FA93D30CF63610BF1B33BB689DB1693D0B79968954EC376CB67E636D46
                                                                                                                                                                                                                                SHA-512:75851CAB4DCDEF5E5AB0DBCE7FED43007EBDD28DC79AF33BFD9F4D5C8CF714660822BBB17CACCA02DC7E1B8CF85A74122481BE30A901F35ACB3D61C5845D5983
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/fire/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M14 6V3c-.85.44-1.7.88-2.55 1.33-1.41.74-2.9 1.34-4.17 2.32-1.13.87-2.02 2.05-2.58 3.37-.46 1.09-.7 2.29-.7 3.48v.14C4 18.26 7.58 22 12 22s8-3.74 8-8.36V2l-6 4zm0 9.7c0 1.82-1.34 3.3-3 3.3s-3-1.47-3-3.3c0-1.19.58-2.24 1.45-2.82L14 10v5.7z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 989

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:PNG image data, 192 x 192, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):938
                                                                                                                                                                                                                                Entropy (8bit):7.355440549055422
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:giqqqqqqqqqqqqqqR9YTI4g87FykD8zButoG8CUUbttH3Uvn:ge4gAtoBuR8C7tkvn
                                                                                                                                                                                                                                MD5:9D63D918311F32D8CB5DF053A11E0768
                                                                                                                                                                                                                                SHA1:254631B961C65EDAAC15577A7EFFFCADFA53C488
                                                                                                                                                                                                                                SHA-256:B490A530AA7FE473868CA661FEC89A10E2A8A763DEFF8F845E603B6CE8C0E8BA
                                                                                                                                                                                                                                SHA-512:22960550755F4EB7A3DA2F0A1DC29FC1B954E5D9F6C25A6D1804E168349B47D286118BEAFA60B6C34530EA61276E1EAB98A67C12733DF1CBCC9A9D2A161C0D33
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.gstatic.com/youtube/img/branding/favicon/favicon_192x192.png
                                                                                                                                                                                                                                Preview:.PNG........IHDR.............e..5...cPLTE.................................................... ..........PP.............@@....``....00.pp...........tRNS.@... 0`....p.P........IDATx.....@..P.qH.?.7{....k.l...........!......w..l.iq_#b......)"Vw...#2..O...R....G...a.T0..O....V...cN...3....^u$...^.4Ph+q..V....<...8vPI{.....8...Q....V.i...B...h.;...N....Ja7.pJ.'..N 5?.a.+n....U.+.p........../E.v1.`..l... ..3../C.Q.s.TK%.3x.w....`....}!hZ.R......^...}K.....X....Ls(.9....x....J&...........@.....d.... .0.s.L.1@_....w5.q.6C.r.l...%....9..d.`<....}Q........9..d.........C2.0....fs......._(.!..^.J..\o....>R.......w_l.Z..].....p.............g.f...g}..=j..l)$.a..q.<.G..C......{...=........,...a........\i..W........<\..t...UDK.A...[.B..+...H.,C..1.=M..q.$.J...&....HX9<...2..O.&x,2Mv.2M9./.....}.e....6.*......../......!R.N...].....xy.i.P.n.M....q?B..x...#.>A.#..p.I...!........=a........4.........IEND.B`.

                                                                                                                                                                                                                                Chrome Cache Entry: 990

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):42
                                                                                                                                                                                                                                Entropy (8bit):2.9881439641616536
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                                                                                MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                                                                                SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                                                                                SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                                                                                SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.google.com/pagead/lvz?evtid=ACd6Kty5g32jNnDdsyrbIDEjOgTNYg4w4501msf1dHhWmgBZAw-NFGa_-lqbny2TlNGRrS8KK6o2huT2FoLx2gdR9TSxMvCsPg&req_ts=1708479556&pg=MainAppBootstrap%3AHome&az=1&sigh=AB9vU42r4CNcP1wCn_GDaaKOHLsRIagioQ
                                                                                                                                                                                                                                Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                                                                                Chrome Cache Entry: 991

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (533)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):5547
                                                                                                                                                                                                                                Entropy (8bit):5.234104150395812
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:+E8YzVFXsVws8HYnkfI+C4yVdbaiGkNF2LSaAuEeRzgf5j6YJR79hamaWslv0Rw:+ajsVws8Hlzg2i/N9hzWgf5jhJR79haZ
                                                                                                                                                                                                                                MD5:936A7C8159737DF8DCE532F9EA4D38B4
                                                                                                                                                                                                                                SHA1:8834EA22EFF1BDFD35D2EF3F76D0E552E75E83C5
                                                                                                                                                                                                                                SHA-256:3EA95AF77E18116ED0E8B52BB2C0794D1259150671E02994AC2A8845BD1AD5B9
                                                                                                                                                                                                                                SHA-512:54471260A278D5E740782524392249427366C56B288C302C73D643A24C96D99A487507FBE1C47E050A52144713DFEB64CD37BC6359F443CE5F8FEB1A2856A70A
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/desktop/87423d78/jsbin/intersection-observer.min.vflset/intersection-observer.min.js
                                                                                                                                                                                                                                Preview:/*.. Copyright 2016 Google Inc. All Rights Reserved... Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE... https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document..*/.(function(f,h){function t(a){this.time=a.time;this.target=a.target;this.rootBounds=a.rootBounds;this.boundingClientRect=a.boundingClientRect;this.intersectionRect=a.intersectionRect||q();this.isIntersecting=!!a.intersectionRect;a=this.boundingClientRect;a=a.width*a.height;var b=this.intersectionRect;b=b.width*b.height;this.intersectionRatio=a?b/a:this.isIntersecting?1:0}function d(a,b){b=b||{};if("function"!=typeof a)throw Error("callback must be a function");if(b.root&&1!=b.root.nodeType)throw Error("root must be an Element");.this.g=y(this.g.bind(this),this.B);this.D=a;this.h=[];this.i=[];this.s=this.L(b.rootMargin);this.thresholds=this.J(b.threshold);this.root=b.root||null;this.rootMargin=this.s.map(function(c){return c.value+c.unit}).join(" ")}function y(a,b){var c=null;return function

                                                                                                                                                                                                                                Chrome Cache Entry: 992

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):9179
                                                                                                                                                                                                                                Entropy (8bit):7.877264721546721
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:192:GVvTRPaPXrrz7ue95Y9BR8phJbJxp+TvMilhZdOa:GVvcPXrr3J29BAH/p+TrZ
                                                                                                                                                                                                                                MD5:E0A46F717E937C1FF93A68598A16C215
                                                                                                                                                                                                                                SHA1:6D7FD4E6B466418E3534B2831D3427E709EABEEA
                                                                                                                                                                                                                                SHA-256:DFB154FEB249B4FAC9F612FAF6B6C52495FAD45CB6EC854867B7655E6A647357
                                                                                                                                                                                                                                SHA-512:0FFB530C2AA49890C62D531D35C3A69B95CC2960403E9DE25FEA7255FA1CAEE118E3DC686D7531CFAE5DADD1B3957E35CDB7FA9D54CA9BC41D0DC6C28D530120
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://scontent-lga3-2.xx.fbcdn.net/v/t15.5256-10/423532078_25190230047235004_3051633090903366259_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=P5tCpKCCfDAAX-uuCo7&_nc_ht=scontent-lga3-2.xx&oh=00_AfAg5EUEYMmGzdPpJKsZvvnN-goZuxA33Hp2DCt5LO_VvA&oe=65DACAA6
                                                                                                                                                                                                                                Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7101000027050000470a0000720b00007d0c00001f110000fe16000019180000671900008d1a0000db230000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."................................................................................ ................................................7.&.Y....:7..N.DO?o....bW...c......8...>......d0.i]...f.}{.[.z.-.jm(....y...#.^[.../.I.,...kK^.6+..E........j.W...4..........7..Bw.t....ZM..y<..t|......|....W.KF.vnz.../g.....]..2...b#Y.b.l...rW..Bu0..z!G....om.56..WB......F.....L.2....;x.[s.v...ej.W...$.).b.S+.;...6./.e....V..fO..2.._d.a...b...........*Fr._.GL.x.+iz.c.5../_.>+...s...E...{<..[Z...i..o-u[..K..a..................`.N..f3]3....eMT.?MU..mj>Z...S..6.W..'.....8.].V..wx..U6..<.cF.t..+2...-*.K.....;$./.......[.jW.....E4...t2;>.1..b.....Qs...n..".H..S.NU.|.#...Z./

                                                                                                                                                                                                                                Chrome Cache Entry: 993

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):311
                                                                                                                                                                                                                                Entropy (8bit):4.773843844737949
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:6:tI9mc4slhohC/vmI4tSSJhrtldwFSrSLwKTksQchiR29UZqbivGSY:t4noU/vmRtXrtvwFSgTksJh42K9pY
                                                                                                                                                                                                                                MD5:D5E9A724519F1A72A4FEECDEA710B2D7
                                                                                                                                                                                                                                SHA1:75040CDBB6269D16066A1CC97973CBD35FB3EAF6
                                                                                                                                                                                                                                SHA-256:119BEF082F4459AC47AC8C95CC7F5901D60BF2AFE47DE7314E479BDA835CD593
                                                                                                                                                                                                                                SHA-512:55A2C26244423311D30C64F06E1AFAD3035D318F7948FED5F2D386FFE9AF1C48077F59036FB1B8BD368875F953CC2F2BE627CD6F5231CEE5119961CA523E8716
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/arrow_time/v8/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.97 16.95 10 13.87V7h2v5.76l4.03 2.49-1.06 1.7zM12 2C8.73 2 5.8 3.44 4 5.83V3.02H2V9h6V7H5.62C7.08 5.09 9.36 4 12 4c4.41 0 8 3.59 8 8s-3.59 8-8 8-8-3.59-8-8H2c0 5.51 4.49 10 10 10s10-4.49 10-10S17.51 2 12 2z"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 994

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):6529
                                                                                                                                                                                                                                Entropy (8bit):4.679709782974826
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:96:xm6jey1gwRj0yKmn1Z2rUKO5YhhzFEyDeg5n:M6CIgwJ0xm1wS5Yvzt
                                                                                                                                                                                                                                MD5:BFC8E752C754A9B52D6BD4A963A7B9C3
                                                                                                                                                                                                                                SHA1:7DDEF10D9AD3F43C89164B7DEBBC9CE26512B036
                                                                                                                                                                                                                                SHA-256:704A5E15AE1068E4DF52A8BCFF04270EFDAD595CF685E0ECCFF86AB335471A46
                                                                                                                                                                                                                                SHA-512:FF6415C30F7839666CE0BDB20FEA71D19630EA75904A4AAD710DC6431604532FBA48CFDA4B326BEAA6502ED727A0A9208DD624A4AC37B7601526BD611D7364BA
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://www.youtube.com/s/search/audio/failure.mp3:2f7070b0cd5e04:0
                                                                                                                                                                                                                                Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz.......................~.......k...................a...c...[...Z...c...`...d..._...^...\...e..."....stco................udta....meta......."hdlr........mdirappl.............nilst.....nam....data........error....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000063 0000000000004B5D 0000000

                                                                                                                                                                                                                                Chrome Cache Entry: 995

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):184
                                                                                                                                                                                                                                Entropy (8bit):5.038914846080771
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3:tIsqDmJS4RKb5hL6Fb0zVjXRH8+hHiATcvXjXRHRcBHeQR+HEp3JdZFQENIfCyHn:tI9mc4slhLJ9hC/vm+QqaXFXaKyHSbE
                                                                                                                                                                                                                                MD5:C71D43D3179551ACAFF38A6A24DEDA71
                                                                                                                                                                                                                                SHA1:9BE42687E42147DBFEA9C1CA9486CCFE6DAB9F96
                                                                                                                                                                                                                                SHA-256:4402C4D35A422097E5AC692FF4EF5182F2E3B72F5A0F710C230A18D6449C688A
                                                                                                                                                                                                                                SHA-512:11BBD2FAC3FF1C144F3F18C60975DD679DEC6C23081621DB874DD1057906A5085B73E998332E1B2C2E511AE55D481980DC3E011588487D2779297B6119BCC79B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/home/v7/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><g><path d="M4 21V10.08l8-6.96 8 6.96V21h-6v-6h-4v6H4z"/></g></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 996

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):5430
                                                                                                                                                                                                                                Entropy (8bit):2.6465732373896285
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:24:Es5ed8vZa+/kffJTyN5J5iXSvjDxatgFFjiZq1MJUikeVgl2fwFfBaTzh4mpCbak:2fq3OqXAzh4jaJV9HxG8Q
                                                                                                                                                                                                                                MD5:3E764F0F737767B30A692FAB1DE3CE49
                                                                                                                                                                                                                                SHA1:58FA0755A8EE455819769EE0E77C23829BF488DD
                                                                                                                                                                                                                                SHA-256:88AE5454A7C32C630703440849D35C58F570D8EECC23C071DBE68D63CE6A40D7
                                                                                                                                                                                                                                SHA-512:2831536A2CA9A2562B7BE1053DF21C2ED51807C9D332878CF349DC0B718D09EEB587423B488C415672C89E42D98D9A9218FACE1FCF8E773492535CB5BD67E278
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://static.xx.fbcdn.net/rsrc.php/yT/r/aGT3gskzWBf.ico
                                                                                                                                                                                                                                Preview:............ .h...&... .... .........(....... ..... ..........................................h. .f...............f...g...d.@.........................`...e...f...f...............f...f...f...e...p...............`...f...f...f...f...............f...f...f...f...f...p...........e...f...f...f...f...............f...f...f...f...f...e.......d.@.f...f...f...f...f...............f...f...f...f...f...f...h. .e...f...f...f....U..........................y'..f...f...f...g...f...f...f...f...............................U..f...f...f...f...f...f...f...f..................................f...f...f...f...f...f...f...f...f...f...............f...f...f...f...f...f...f...f...f...f...f...f...f...............p...f...f...f...f...f...f...f...f...f...f...f...f...................d...U..f...f...f...e...h. .f...f...f...f...f....d......................f...f...f...h.@.....f...f...f...f...f...f....t.................f...f...f...........p...f...f...f...f...f...f...f...f...f...f...f...f...`...............p...f...f...f...f

                                                                                                                                                                                                                                Chrome Cache Entry: 997

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):631
                                                                                                                                                                                                                                Entropy (8bit):4.523426024540581
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:12:t47N9U/vmRlNAz9Cf2+uFNxLjRJqpOyaIj24iexYNjbnME:t4jU/vwAz9C2NDx7MraCvC/ME
                                                                                                                                                                                                                                MD5:CF8624D2CB9D056B69F4240D26676F42
                                                                                                                                                                                                                                SHA1:B6D1C7111D039427E2605490C40992C47021E1C7
                                                                                                                                                                                                                                SHA-256:384FBC48B9DAAAAE43546C01BAAC0F19EAF764549ABC66FE69A9E9675A14D0A3
                                                                                                                                                                                                                                SHA-512:8500302D48ACDDAD24B051A44482305D92B349A054BF006E0FCA901DC55CC06DF826D28A39432ED7A92B7FB76E1D351945606DA87A0F0D3127E66D1CF2DDC90B
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/i/youtube_fill/broadcast/v2/24px.svg
                                                                                                                                                                                                                                Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M13 13.72V22h-2v-8.28c-.6-.35-1-.98-1-1.72 0-1.1.9-2 2-2s2 .9 2 2c0 .74-.4 1.38-1 1.72zm-5.23 2.53 1.42-1.42C8.45 14.11 8 13.11 8 12c0-2.21 1.79-4 4-4s4 1.79 4 4c0 1.11-.45 2.11-1.18 2.83l1.42 1.42C17.33 15.16 18 13.66 18 12c0-3.31-2.69-6-6-6s-6 2.69-6 6c0 1.66.67 3.16 1.77 4.25zm-2.83 2.83 1.42-1.42C4.9 16.21 4 14.21 4 12c0-4.41 3.59-8 8-8s8 3.59 8 8c0 2.21-.9 4.21-2.35 5.66l1.42 1.42C20.88 17.27 22 14.77 22 12c0-5.52-4.48-10-10-10S2 6.48 2 12c0 2.77 1.12 5.27 2.94 7.08z" fill-rule="evenodd"/></svg>

                                                                                                                                                                                                                                Chrome Cache Entry: 998

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):216276
                                                                                                                                                                                                                                Entropy (8bit):5.455491059432931
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:3072:E0nzyu8ItYoHFldaY4xzuQVLlGDPcHGcpP:lnCuYgTaY4/GqGQP
                                                                                                                                                                                                                                MD5:A1C97A27D5C64B97D4E96D5EACA3B8AA
                                                                                                                                                                                                                                SHA1:89C48372DBAD07D2EFE10475B14E6CDCA0BC2E80
                                                                                                                                                                                                                                SHA-256:C150006B9F983B4716C91B10C2E5888857F52E303BE151F27A9DF26FF2CE900B
                                                                                                                                                                                                                                SHA-512:7D18B750F8293E0606A43FC114D7E2AA0BD671C1A552F955A5A0137AB9F03ABD27AB03E3127E0E7BAE8B5947F301B5139FA0227DE8B6E2B8FB232A2679F5AD18
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.QKwFb1UtQb4.es5.O/am=P2CJhmMBEJhZTvP3jJPDAAAAAAAAAAAAawA7/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFU0Eb88gCMWemHf1wS2H0QUzNV-Q/m=_b,_tp"
                                                                                                                                                                                                                                Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x689603f, 0x2040058e, 0x3f34e599, 0x30e4e33d, 0x0, 0x0, 0x3006b000, 0xe, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Ra,haa,$a,cb,db,eb,fb,iaa,gb,lb,jaa,kaa,pb,naa,paa,Eb,qaa,taa,vaa,Aaa,Qb,Caa,Daa,Iaa,Oaa,Paa,Maa,Qaa,Vaa,Waa,Yaa,Zaa,$aa,aba,Lc,dba,cba,fba,Pc,Oc,hba,gba,kba,jba,Vc,nba,oba,dd,cd,Rc,zba,wba,Aba,Bba,Eba,Gba,Hba,uba,Qd,Rd,aca,je,cca,ke,dca,fca,hca,lca,mca,nca,oca,rca,tca,xca,yca,Cca,Mca,Ica,Oca,Qca,Rca,Uca,Wca,Zca,$ca,ada,bda,cda,fda,jf,gda,ida,lda,mda,aaa,nda,Af,oda,Cf,pda,qda,Ef,sda,Gf,zda,Dda,Cda,Of,Fda;_.aa=function(a){return fu

                                                                                                                                                                                                                                Chrome Cache Entry: 999

                                                                                                                                                                                                                                Download File
                                                                                                                                                                                                                                Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                File Type:Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
                                                                                                                                                                                                                                Category:downloaded
                                                                                                                                                                                                                                Size (bytes):15860
                                                                                                                                                                                                                                Entropy (8bit):7.988022700476719
                                                                                                                                                                                                                                Encrypted:false
                                                                                                                                                                                                                                SSDEEP:384:S7qmPTF4N21t//YW2FS6+1XxrsbGmjlAbvqMmtCN:S621tHY4xwbGmjloSM7N
                                                                                                                                                                                                                                MD5:E9F5AAF547F165386CD313B995DDDD8E
                                                                                                                                                                                                                                SHA1:ACDEF5603C2387B0E5BFFD744B679A24A8BC1968
                                                                                                                                                                                                                                SHA-256:F5AEBDFEA35D1E7656EF4ACC5DB1F243209755AE3300943EF8FC6280F363C860
                                                                                                                                                                                                                                SHA-512:2A71EDB5490F286642A874D52A1969F54282BC43CB24E8D5A297E13B320321FB7B7AF5524EAC609CF5F95EE08D5E4EC5803E2A3C8D13C09F6CC38713C665D0CE
                                                                                                                                                                                                                                Malicious:false
                                                                                                                                                                                                                                URL:https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
                                                                                                                                                                                                                                Preview:wOF2......=...........=..........................d.....^.`.. .H..<........8........6.$.... ..~. ..)..~E......6..J..`.. :.....8.;..5......!.l.j.%SX.SDm...RXh...&.X......5..._...............@...8...Gi..g.;9..'.Q......1..5.U.....w.+.hn..........c.....5.#{..%.#.JP*..i.J..U(.6.D5V.<"Ex6"...k..[..{.?.d2....{.........*W.......S...hT,.l..'.9.;[@..._.L..|+...)......S...9F......T..t...-=X.:FtZ..uZ.[.?..f<.....@.....'...I...e..........8.?..-R.3,%X...I2|.Wk{i...V2C....H$.H.LH.{.........(...6U..%W[t.R....j.........iS..%..L....rf.=..7..9i.I...1.Mj..C..u.B.........vJ.....+.u$.=..3..T..R.._.gs...6).$.-.PUH..Hl....WDd.......fK.(B.F1>..5.._[..]}VA#X...c.....%.(s50...m...^...1...'.$U*H.t...H...s.AZu...'...8.p...@.@.....q..Y.#.....#.....G.....G@..o8. A........:.........S.:..N.S.j.....tav.}.9h..s.....he.......{,~k...,eK.z}.......5%G...l.uCK.....V..............m.....U}.Sz..Z.c.{.....:..g......>h..'|Z........a....^.b...o.>...g........f../w'....Ja.o(

                                                                                                                                                                                                                                Static File Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                Entropy (8bit):7.9618356942587125
                                                                                                                                                                                                                                TrID:
                                                                                                                                                                                                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                File name:file.exe
                                                                                                                                                                                                                                File size:2'332'672 bytes
                                                                                                                                                                                                                                MD5:9565a774cce1318d00aad201d54179ad
                                                                                                                                                                                                                                SHA1:9369239b7c872d3cc46e55178eeda3cc6652e2e3
                                                                                                                                                                                                                                SHA256:9911129661bce9c536c1232b12b2aa19501d9dfae099c146d25308c7bb6839ac
                                                                                                                                                                                                                                SHA512:4ebe7b64b0ee4ebdd1ef355d3b0b5f4cff22c83ac47e1fe317634ce3d8ba99494c5fa2790d541797c3dc52f4a71230361dc80bc2dfb4675f7f1196d89f1b0e3a
                                                                                                                                                                                                                                SSDEEP:49152:eHex9yDOkBt8Oi0WWY6KtnHvjQ2SUueEMpZ0Q7zax8UFQdhoOIEgXlLv:egbkB18jQ2fueEA0Q7zait3IEmv
                                                                                                                                                                                                                                TLSH:2BB53361AD797C35F23E22B48F071877AA924919416057FDB09F3EB23C71A5346BA2CC
                                                                                                                                                                                                                                File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C...............L.......L.......L.......H.G.....H.......H.......H...R...L.......L.......L.........................E.......-....

                                                                                                                                                                                                                                File Icon

                                                                                                                                                                                                                                Icon Hash:b2b2b3b2e4e66638

                                                                                                                                                                                                                                Static PE Info

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Entrypoint:0x99e000
                                                                                                                                                                                                                                Entrypoint Section:.taggant
                                                                                                                                                                                                                                Digitally signed:false
                                                                                                                                                                                                                                Imagebase:0x400000
                                                                                                                                                                                                                                Subsystem:windows gui
                                                                                                                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                                DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                Time Stamp:0x65D4404E [Tue Feb 20 06:01:50 2024 UTC]
                                                                                                                                                                                                                                TLS Callbacks:
                                                                                                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                                                                                                OS Version Major:6
                                                                                                                                                                                                                                OS Version Minor:0
                                                                                                                                                                                                                                File Version Major:6
                                                                                                                                                                                                                                File Version Minor:0
                                                                                                                                                                                                                                Subsystem Version Major:6
                                                                                                                                                                                                                                Subsystem Version Minor:0
                                                                                                                                                                                                                                Import Hash:2eabe9054cad5152567f0699947a2c5b

                                                                                                                                                                                                                                Entrypoint Preview

                                                                                                                                                                                                                                Instruction
                                                                                                                                                                                                                                jmp 00007FF9E204EF6Ah
                                                                                                                                                                                                                                pcmpeqd mm4, qword ptr [ebx]
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add cl, ch
                                                                                                                                                                                                                                add byte ptr [eax], ah
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [esi], al
                                                                                                                                                                                                                                or al, byte ptr [eax]
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], dh
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax+eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                and al, byte ptr [eax]
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add dword ptr [eax+00000000h], eax
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                adc byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                pop es
                                                                                                                                                                                                                                or al, byte ptr [eax]
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax+0Ah], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add dword ptr [eax+00000000h], eax
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                adc byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add ecx, dword ptr [edx]
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                xor byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                or al, 80h
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                adc byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                push es
                                                                                                                                                                                                                                or al, byte ptr [eax]
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], dh
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                or byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [esi], al
                                                                                                                                                                                                                                add byte ptr [eax], 00000000h
                                                                                                                                                                                                                                add byte ptr [eax], al
                                                                                                                                                                                                                                add byte ptr [eax], al

                                                                                                                                                                                                                                Data Directories

                                                                                                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x13b0540x68.idata
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x1370000x3168.rsrc
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x13b1f80x8.idata
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                Sections

                                                                                                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                0x10000x1360000x8f00062914a828fb6a104d2b7b6f54d549be7False0.9994673295454546data7.989426793160249IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .rsrc0x1370000x31680x1800b252d115e99482aff7b7b4e94c67732fFalse0.9195963541666666data7.615100777099426IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .idata 0x13b0000x10000x2001e17ac6f9d72045027c75c82e74ad637False0.14453125data0.9942709484982628IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                0x13c0000x2bb0000x200f4690146d9e49afa29e7cc9fe67ad116unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                nlyzwaah0x3f70000x1a60000x1a56000a1364b12a3f3a49ce085ba590286368False0.9910513154479383data7.9524435905525435IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                lkbejoib0x59d0000x10000x400b66a513fb0727538e43cdd503c0a7070False0.7783203125data6.073919583711129IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                .taggant0x59e0000x30000x2200f8662ce161b0af42eb643c8ec116f242False0.05480238970588235DOS executable (COM)0.6516153450010875IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                                                                                                                                                                                                Resources

                                                                                                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                RT_ICON0x5996d40x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0RussianRussia0.3333333333333333
                                                                                                                                                                                                                                RT_ICON0x5999bc0x128Device independent bitmap graphic, 16 x 32 x 4, image size 0RussianRussia0.5777027027027027
                                                                                                                                                                                                                                RT_ICON0x599ae40x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0RussianRussia0.4165162454873646
                                                                                                                                                                                                                                RT_ICON0x59a38c0x568Device independent bitmap graphic, 16 x 32 x 8, image size 0RussianRussia0.42991329479768786
                                                                                                                                                                                                                                RT_ICON0x59a8f40x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0RussianRussia0.5159474671669794
                                                                                                                                                                                                                                RT_ICON0x59b99c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 0RussianRussia0.6338652482269503
                                                                                                                                                                                                                                RT_GROUP_ICON0x59be040x5adataRussianRussia0.7111111111111111
                                                                                                                                                                                                                                RT_VERSION0x59be5e0x33cdataRussianRussia0.44806763285024154
                                                                                                                                                                                                                                RT_MANIFEST0x59c19a0x2e6XML 1.0 document, ASCII text, with CRLF line terminators0.45417789757412397
                                                                                                                                                                                                                                RT_MANIFEST0x59c4800x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                                                                                                                                                                                                                Imports

                                                                                                                                                                                                                                DLLImport
                                                                                                                                                                                                                                kernel32.dlllstrcpy

                                                                                                                                                                                                                                Possible Origin

                                                                                                                                                                                                                                Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                RussianRussia
                                                                                                                                                                                                                                EnglishUnited States

                                                                                                                                                                                                                                Network Behavior

                                                                                                                                                                                                                                ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                Statistics

                                                                                                                                                                                                                                CPU Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                Memory Usage

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                                                                                                Behavior

                                                                                                                                                                                                                                Click to jump to process

                                                                                                                                                                                                                                System Behavior

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:0
                                                                                                                                                                                                                                Start time:02:38:50
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                Imagebase:0xf90000
                                                                                                                                                                                                                                File size:2'332'672 bytes
                                                                                                                                                                                                                                MD5 hash:9565A774CCE1318D00AAD201D54179AD
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:2
                                                                                                                                                                                                                                Start time:02:38:54
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                Imagebase:0xf50000
                                                                                                                                                                                                                                File size:187'904 bytes
                                                                                                                                                                                                                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:3
                                                                                                                                                                                                                                Start time:02:38:54
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:4
                                                                                                                                                                                                                                Start time:02:38:54
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                Imagebase:0xf50000
                                                                                                                                                                                                                                File size:187'904 bytes
                                                                                                                                                                                                                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:5
                                                                                                                                                                                                                                Start time:02:38:54
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:6
                                                                                                                                                                                                                                Start time:02:38:56
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                Imagebase:0xd70000
                                                                                                                                                                                                                                File size:2'332'672 bytes
                                                                                                                                                                                                                                MD5 hash:9565A774CCE1318D00AAD201D54179AD
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                • Detection: 54%, Virustotal, Browse
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:7
                                                                                                                                                                                                                                Start time:02:38:56
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                                                                                Imagebase:0xd70000
                                                                                                                                                                                                                                File size:2'332'672 bytes
                                                                                                                                                                                                                                MD5 hash:9565A774CCE1318D00AAD201D54179AD
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:8
                                                                                                                                                                                                                                Start time:02:39:05
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                                                                                                                                                                                                                Imagebase:0xb80000
                                                                                                                                                                                                                                File size:2'332'672 bytes
                                                                                                                                                                                                                                MD5 hash:9565A774CCE1318D00AAD201D54179AD
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2980143223.000000000059F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2980143223.00000000005A4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:9
                                                                                                                                                                                                                                Start time:02:39:08
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\SIHClient.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\System32\sihclient.exe /cv oDBIuu78qUSLDogbPZYF5w.0.2
                                                                                                                                                                                                                                Imagebase:0x7ff6c9ac0000
                                                                                                                                                                                                                                File size:380'720 bytes
                                                                                                                                                                                                                                MD5 hash:8BE47315BF30475EEECE8E39599E9273
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:moderate
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:10
                                                                                                                                                                                                                                Start time:02:39:11
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\1zSWTheo8gASwgtmbVnB.exe"
                                                                                                                                                                                                                                Imagebase:0x6e0000
                                                                                                                                                                                                                                File size:918'016 bytes
                                                                                                                                                                                                                                MD5 hash:1E1CA4D43582C075F0CFF2992A8E6FEB
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:low
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:11
                                                                                                                                                                                                                                Start time:02:39:12
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:12
                                                                                                                                                                                                                                Start time:02:39:12
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:13
                                                                                                                                                                                                                                Start time:02:39:12
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:15
                                                                                                                                                                                                                                Start time:02:39:12
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=1964,i,5887355526268781908,1189009886419855111,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:16
                                                                                                                                                                                                                                Start time:02:39:13
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:17
                                                                                                                                                                                                                                Start time:02:39:13
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1984,i,6749347610235560040,8445991958934204639,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:18
                                                                                                                                                                                                                                Start time:02:39:14
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2020,i,9349519310739507833,11996823178141009930,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Reputation:high
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:19
                                                                                                                                                                                                                                Start time:02:39:14
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1976,i,11539279321236040917,10474362654299226247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:20
                                                                                                                                                                                                                                Start time:02:39:14
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:21
                                                                                                                                                                                                                                Start time:02:39:15
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                                                                                Imagebase:0xf50000
                                                                                                                                                                                                                                File size:187'904 bytes
                                                                                                                                                                                                                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:22
                                                                                                                                                                                                                                Start time:02:39:15
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:23
                                                                                                                                                                                                                                Start time:02:39:15
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:24
                                                                                                                                                                                                                                Start time:02:39:15
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:25
                                                                                                                                                                                                                                Start time:02:39:15
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:26
                                                                                                                                                                                                                                Start time:02:39:15
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                                                                                                                                                                                                                Imagebase:0xb80000
                                                                                                                                                                                                                                File size:2'332'672 bytes
                                                                                                                                                                                                                                MD5 hash:9565A774CCE1318D00AAD201D54179AD
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:27
                                                                                                                                                                                                                                Start time:02:39:16
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2080,i,6001142355176275865,11694759345999334586,262144 /prefetch:3
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:28
                                                                                                                                                                                                                                Start time:02:39:16
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:29
                                                                                                                                                                                                                                Start time:02:39:16
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                                                                                                                                                                                                                                Imagebase:0x7ff715980000
                                                                                                                                                                                                                                File size:3'242'272 bytes
                                                                                                                                                                                                                                MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:30
                                                                                                                                                                                                                                Start time:02:39:16
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                                                                                Imagebase:0xf50000
                                                                                                                                                                                                                                File size:187'904 bytes
                                                                                                                                                                                                                                MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:31
                                                                                                                                                                                                                                Start time:02:39:16
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                File size:862'208 bytes
                                                                                                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:32
                                                                                                                                                                                                                                Start time:02:39:17
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=2028,i,4605008049051892939,13077336860849041403,262144 /prefetch:3
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:33
                                                                                                                                                                                                                                Start time:02:39:17
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                                                                                Imagebase:0x650000
                                                                                                                                                                                                                                File size:1'889'792 bytes
                                                                                                                                                                                                                                MD5 hash:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000002.2976732828.0000000000651000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000021.00000003.2482885181.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 100%, Avira
                                                                                                                                                                                                                                • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                • Detection: 60%, Virustotal, Browse
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:34
                                                                                                                                                                                                                                Start time:02:39:17
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:35
                                                                                                                                                                                                                                Start time:02:39:17
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:36
                                                                                                                                                                                                                                Start time:02:39:17
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1120 --field-trial-handle=2024,i,16006183332478894821,13298773514920591943,262144 /prefetch:3
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:37
                                                                                                                                                                                                                                Start time:02:39:18
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:38
                                                                                                                                                                                                                                Start time:02:39:18
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:39
                                                                                                                                                                                                                                Start time:02:39:19
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:40
                                                                                                                                                                                                                                Start time:02:39:19
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2720 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:3
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:41
                                                                                                                                                                                                                                Start time:02:39:19
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:42
                                                                                                                                                                                                                                Start time:02:39:22
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                                                                                Imagebase:0x650000
                                                                                                                                                                                                                                File size:1'889'792 bytes
                                                                                                                                                                                                                                MD5 hash:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002A.00000002.2883089894.0000000000651000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002A.00000003.2481062424.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:43
                                                                                                                                                                                                                                Start time:02:39:22
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:44
                                                                                                                                                                                                                                Start time:02:39:22
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe
                                                                                                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\Temp\heidizS9SzeRnCJb5\_z8_twA5gL3uyAKSYBl4.exe"
                                                                                                                                                                                                                                Imagebase:0xca0000
                                                                                                                                                                                                                                File size:1'889'792 bytes
                                                                                                                                                                                                                                MD5 hash:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                Has elevated privileges:true
                                                                                                                                                                                                                                Has administrator privileges:true
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Yara matches:
                                                                                                                                                                                                                                • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002C.00000002.2976908105.0000000000CA1000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
                                                                                                                                                                                                                                • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002C.00000003.2396808803.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:46
                                                                                                                                                                                                                                Start time:02:39:22
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:47
                                                                                                                                                                                                                                Start time:02:39:25
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:48
                                                                                                                                                                                                                                Start time:02:39:25
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2260 -parentBuildID 20230927232528 -prefsHandle 2164 -prefMapHandle 2156 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78885992-7c24-4bea-b4cd-80bc1adb5941} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fbfe16e710 socket
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:49
                                                                                                                                                                                                                                Start time:02:39:25
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6352 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:50
                                                                                                                                                                                                                                Start time:02:39:25
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2600,i,3848527723112303336,5816276702811820383,262144 /prefetch:8
                                                                                                                                                                                                                                Imagebase:0x7ff6c1cf0000
                                                                                                                                                                                                                                File size:4'210'216 bytes
                                                                                                                                                                                                                                MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:52
                                                                                                                                                                                                                                Start time:02:39:28
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe"
                                                                                                                                                                                                                                Imagebase:0xf00000
                                                                                                                                                                                                                                File size:1'889'792 bytes
                                                                                                                                                                                                                                MD5 hash:F2DFD8B4E7B7BE57BB23484FC9D14430
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Antivirus matches:
                                                                                                                                                                                                                                • Detection: 100%, Avira
                                                                                                                                                                                                                                • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                • Detection: 60%, Virustotal, Browse
                                                                                                                                                                                                                                Has exited:true

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:53
                                                                                                                                                                                                                                Start time:02:39:28
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3672 -childID 1 -isForBrowser -prefsHandle 1216 -prefMapHandle 3664 -prefsLen 21867 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe175a33-28a2-4047-aeec-757513839c5e} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8f78ca10 tab
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                General

                                                                                                                                                                                                                                Target ID:54
                                                                                                                                                                                                                                Start time:02:39:28
                                                                                                                                                                                                                                Start date:21/02/2024
                                                                                                                                                                                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                                                                                                Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2556 -childID 2 -isForBrowser -prefsHandle 4004 -prefMapHandle 2968 -prefsLen 22057 -prefMapSize 237879 -jsInitHandle 1416 -jsInitLen 234236 -parentBuildID 20230927232528 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a7ce19a-c0e1-4606-ade3-f9e411e1fb00} 10616 "\\.\pipe\gecko-crash-server-pipe.10616" 1fb8b43cf50 tab
                                                                                                                                                                                                                                Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                File size:676'768 bytes
                                                                                                                                                                                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                Has elevated privileges:false
                                                                                                                                                                                                                                Has administrator privileges:false
                                                                                                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                                                                                                Has exited:false

                                                                                                                                                                                                                                Disassembly

                                                                                                                                                                                                                                Reset < >

                                                                                                                                                                                                                                  Execution Graph

                                                                                                                                                                                                                                  Execution Coverage:13.6%
                                                                                                                                                                                                                                  Dynamic/Decrypted Code Coverage:5.9%
                                                                                                                                                                                                                                  Signature Coverage:70.8%
                                                                                                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                                                                                                  Total number of Limit Nodes:145
                                                                                                                                                                                                                                  execution_graph 67383 4d204b0 67384 4d2049e Process32NextW 67383->67384 67386 4d204bf 67383->67386 67384->67386 67387 4d9045c 67388 4d9041d Process32FirstW 67387->67388 67389 4d9043b 67387->67389 67388->67389 67390 107cdc2 67393 107cc32 67390->67393 67394 107cc5f std::locale::_Setgloballocale 67393->67394 67400 107cac3 67394->67400 67396 107cca8 67397 107ccae 67396->67397 67404 107ccc9 67396->67404 67401 107cacf __fread_nolock std::_Lockit::_Lockit 67400->67401 67407 107cb4a 67401->67407 67403 107cae6 std::locale::_Setgloballocale 67403->67396 67405 107ccd3 std::locale::_Setgloballocale 67404->67405 67406 107ccef ExitProcess 67405->67406 67408 107cb56 __fread_nolock std::locale::_Setgloballocale 67407->67408 67409 107cbba std::locale::_Setgloballocale 67408->67409 67411 107ffc4 RtlFreeHeap __EH_prolog3 std::locale::_Init std::locale::_Setgloballocale 67408->67411 67409->67403 67411->67409 67412 faa150 67413 faa1bf __fread_nolock 67412->67413 67414 faa47f 67413->67414 67415 faa2cf 67413->67415 67495 f92040 67414->67495 67474 ffd850 67415->67474 67418 faa2f5 67489 ff5b90 67418->67489 67419 faa484 67498 1072350 67419->67498 67422 faa306 67422->67419 67423 faa367 67422->67423 67494 f92cc0 ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 67423->67494 67424 1072350 3 API calls 67430 faa48e 67424->67430 67426 1072350 3 API calls 67427 fac2fa 67426->67427 67428 faa462 67429 faa3a2 67429->67424 67429->67428 67450 fac1ab Concurrency::cancel_current_task 67430->67450 67501 f92830 67430->67501 67432 fac23d 67433 faa59c 67517 ff5e10 67433->67517 67435 faa5af 67534 f9c430 67435->67534 67450->67426 67450->67432 67475 ffd883 67474->67475 67479 ffd8ae std::locale::_Init 67474->67479 67476 ffd890 67475->67476 67477 ffd8dc 67475->67477 67478 ffd8d3 67475->67478 67630 106ce31 67476->67630 67477->67479 67482 106ce31 std::_Facet_Register 4 API calls 67477->67482 67478->67476 67481 ffd92d 67478->67481 67479->67418 67638 f91fa0 4 API calls 2 library calls 67481->67638 67482->67479 67483 ffd8a3 67483->67479 67485 1072350 3 API calls 67483->67485 67486 ffd937 67485->67486 67639 107b376 67486->67639 67488 ffd954 67488->67418 67490 ff5ba4 67489->67490 67493 ff5bb4 std::locale::_Init 67490->67493 67658 ffbc40 4 API calls 3 library calls 67490->67658 67492 ff5bfa 67492->67422 67493->67422 67494->67429 67659 106b28b 4 API calls 2 library calls 67495->67659 67660 107228c ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock 67498->67660 67500 107235f __Getctype 67502 f928f5 67501->67502 67503 f92846 67501->67503 67504 f92040 4 API calls 67502->67504 67505 f92852 std::locale::_Init 67503->67505 67506 f9287a 67503->67506 67509 f928be 67503->67509 67510 f928b5 67503->67510 67507 f928fa 67504->67507 67505->67433 67511 106ce31 std::_Facet_Register 4 API calls 67506->67511 67661 f91fa0 4 API calls 2 library calls 67507->67661 67514 106ce31 std::_Facet_Register 4 API calls 67509->67514 67516 f92896 std::locale::_Init 67509->67516 67510->67506 67510->67507 67512 f9288d 67511->67512 67513 1072350 3 API calls 67512->67513 67512->67516 67515 f92904 67513->67515 67514->67516 67516->67433 67518 ff5e3a 67517->67518 67519 ff5e4b 67518->67519 67520 ff5ef2 67518->67520 67521 ff5e57 std::locale::_Init 67519->67521 67523 ff5e7c 67519->67523 67526 ff5ebe 67519->67526 67527 ff5eb5 67519->67527 67522 f92040 4 API calls 67520->67522 67521->67435 67524 ff5ef7 67522->67524 67528 106ce31 std::_Facet_Register 4 API calls 67523->67528 67662 f91fa0 4 API calls 2 library calls 67524->67662 67530 106ce31 std::_Facet_Register 4 API calls 67526->67530 67532 ff5e96 std::locale::_Init 67526->67532 67527->67523 67527->67524 67529 ff5e8f 67528->67529 67531 1072350 3 API calls 67529->67531 67529->67532 67530->67532 67532->67435 67632 106ce36 std::_Facet_Register 67630->67632 67633 106ce50 67632->67633 67635 f91fa0 Concurrency::cancel_current_task 67632->67635 67642 107bacc 67632->67642 67633->67483 67634 106ce5c 67634->67634 67635->67634 67646 106e1f1 67635->67646 67638->67483 67655 1084953 67639->67655 67641 107b38e 67641->67488 67645 10849cd __Getctype std::_Facet_Register 67642->67645 67643 10849f6 RtlAllocateHeap 67644 1084a09 67643->67644 67643->67645 67644->67632 67645->67643 67645->67644 67647 106e1fe 67646->67647 67653 f91fe3 67646->67653 67647->67647 67648 107bacc ___std_exception_copy RtlAllocateHeap 67647->67648 67647->67653 67649 106e21b 67648->67649 67650 106e22b 67649->67650 67654 1083258 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock 67649->67654 67652 107b376 ___std_exception_destroy RtlFreeHeap 67650->67652 67652->67653 67653->67483 67654->67650 67656 108495e RtlFreeHeap 67655->67656 67657 1084973 __dosmaperr 67655->67657 67656->67657 67657->67641 67658->67492 67660->67500 67661->67512 67662->67529 67734 fadbb0 WSAStartup 67735 fadbe8 67734->67735 67736 fadca6 67734->67736 67735->67736 67737 fadc74 socket 67735->67737 67737->67736 67738 fadc8a connect 67737->67738 67738->67736 67739 fadc9c closesocket 67738->67739 67739->67736 67739->67737 67740 fdf190 67741 fdf1b6 67740->67741 67742 fe333b 67741->67742 67743 fdf1e1 67741->67743 67813 f92700 4 API calls 67741->67813 67816 fbde70 15 API calls 67741->67816 67744 ff5e10 4 API calls 67743->67744 67745 ff5e10 4 API calls 67743->67745 67744->67743 67746 fdf225 67745->67746 67747 fdf26b 67746->67747 67749 fdf27c 67747->67749 67748 f92830 4 API calls 67748->67749 67749->67748 67750 f92830 4 API calls 67749->67750 67751 fdf2fb 67750->67751 67753 fdf323 67751->67753 68654 fe2ec2 67751->68654 68655 fbde70 67751->68655 67757 fdf335 67753->67757 67754 ff5e10 4 API calls 67755 fe2ee3 67754->67755 67756 ff5e10 4 API calls 67755->67756 67763 fe2eff 67756->67763 67758 fdf351 67757->67758 67759 ff5e10 4 API calls 67758->67759 67760 fdf359 67759->67760 67762 fdf370 67760->67762 67761 f92830 4 API calls 67761->67763 67764 fdf377 67762->67764 67763->67761 67767 fe2fa0 67763->67767 67765 ff5e10 4 API calls 67764->67765 67766 fdf37f 67765->67766 67769 f92700 4 API calls 67766->67769 67767->67767 67768 f92830 4 API calls 67767->67768 67770 fe2fdd 67768->67770 67771 fdf3b9 67769->67771 67772 fbde70 15 API calls 67770->67772 67774 ff5e10 4 API calls 67770->67774 67773 f92700 4 API calls 67771->67773 67772->67770 67775 fdf3f8 67773->67775 67779 fe3016 67774->67779 67776 fbde70 15 API calls 67775->67776 67778 fdf40c 67776->67778 67777 ff5e10 4 API calls 67777->67779 67781 fdf421 67778->67781 67779->67777 67780 fe3060 67779->67780 67786 fe307b 67780->67786 67783 fdf43d 67781->67783 67782 f92830 4 API calls 67782->67786 67786->67782 67793 fe3107 67786->67793 67790 f92830 4 API calls 67790->67793 67792 fbde70 15 API calls 67792->67793 67793->67790 67793->67792 67796 fe313e 67793->67796 67798 fe315a 67796->67798 67802 ff5e10 4 API calls 67798->67802 67803 fe3169 67802->67803 67813->67741 67816->67741 68654->67754 68656 fbdece __fread_nolock 68655->68656 68712 ff9c10 68656->68712 68659 fbebb9 68661 f92700 4 API calls 68659->68661 68660 fbdf2d 68662 ff5e10 4 API calls 68660->68662 68663 fbebc9 68661->68663 68664 fbdf3e 68662->68664 68820 ff4ab0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 68663->68820 68720 fb0780 68664->68720 68667 fbebdf 68669 f92660 3 API calls 68667->68669 68670 fbebb7 68669->68670 68674 f92700 4 API calls 68670->68674 68710 fbec44 std::locale::_Init 68670->68710 68678 fbec1f 68674->68678 68677 fbfbf0 68680 ff8000 5 API calls 68677->68680 68821 ff4ab0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 68678->68821 68686 fbdf77 68680->68686 68688 1072350 3 API calls 68686->68688 68689 fbfd29 68686->68689 68687 fbfd46 68690 f92040 4 API calls 68687->68690 68689->67751 68690->68686 68693 ffd660 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 68693->68710 68697 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 68697->68710 68698 ffbc40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 68698->68710 68702 f9bf00 7 API calls 68702->68710 68705 1002170 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 68705->68710 68708 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 68708->68710 68710->68677 68710->68686 68710->68687 68710->68693 68710->68697 68710->68698 68710->68702 68710->68705 68710->68708 68711 fbfd60 ExitProcess RtlAllocateHeap RtlFreeHeap 68710->68711 68809 ff5b20 68710->68809 68711->68710 68713 ff9c25 68712->68713 68713->68713 68714 ff9c5f 68713->68714 68715 ff9c3f 68713->68715 68716 f92040 4 API calls 68714->68716 68717 ffd850 4 API calls 68715->68717 68718 ff9c64 68716->68718 68719 fbdf05 68717->68719 68719->68659 68719->68660 68721 fb07f2 68720->68721 68722 f92040 4 API calls 68721->68722 68723 fb0b87 68722->68723 68724 1072350 3 API calls 68723->68724 68725 fb0b8c 68724->68725 68822 ff7810 68725->68822 68810 ff5b30 68809->68810 68810->68810 68820->68667 69673 fed030 69674 fed064 69673->69674 69678 fed078 69673->69678 69675 ff5e10 4 API calls 69674->69675 69676 fed073 69675->69676 69679 fcd5a0 69676->69679 69680 fcd5f8 __fread_nolock 69679->69680 69681 f92830 4 API calls 69680->69681 69682 fcd67e 69681->69682 69683 ff9c70 4 API calls 69682->69683 69686 fcd697 69683->69686 69684 106c3b3 GetSystemTimePreciseAsFileTime 69691 fcd702 69684->69691 69685 fced0d 69688 1072350 3 API calls 69685->69688 69686->69684 69686->69685 69687 fced12 69781 106c05c 8 API calls std::locale::_Setgloballocale 69687->69781 69688->69687 69690 fced18 69692 f92040 4 API calls 69690->69692 69691->69687 69691->69691 69693 fcd72f GetFileAttributesA 69691->69693 69699 fcec1d __Mtx_unlock 69691->69699 69694 fced1d 69692->69694 69703 fcd741 __Mtx_unlock 69693->69703 69782 106c05c 8 API calls std::locale::_Setgloballocale 69694->69782 69696 fced23 69697 f92040 4 API calls 69696->69697 69698 fced28 69697->69698 69700 1072350 3 API calls 69698->69700 69699->69678 69701 fced2d 69700->69701 69702 f92040 4 API calls 69701->69702 69704 fced46 69702->69704 69703->69690 69703->69699 69705 ffd850 4 API calls 69703->69705 69706 1072350 3 API calls 69704->69706 69707 fcd7d8 69705->69707 69709 106c3b3 GetSystemTimePreciseAsFileTime 69707->69709 69710 fcd7fa __Mtx_unlock 69709->69710 69710->69694 69710->69696 69710->69699 69711 ffd850 4 API calls 69710->69711 69712 fcd8ec 69711->69712 69747 1072f00 69712->69747 69783 1072e3e 69747->69783 69749 1072f12 69785 1072e4a __fread_nolock 69783->69785 69784 1072e51 69794 1072340 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock 69784->69794 69785->69784 69786 1072e71 69785->69786 69789 1072e61 69786->69789 69790 1084228 69786->69790 69789->69749 69791 1084234 __fread_nolock std::_Lockit::_Lockit 69790->69791 69794->69789 69931 fe3910 69932 fe3950 69931->69932 69933 ff9b50 4 API calls 69932->69933 69934 fe467b 69932->69934 69936 fe4e8e 69932->69936 69935 fe39b9 69933->69935 69937 ff9b50 4 API calls 69934->69937 70049 f9bf90 69935->70049 69942 ff9b50 4 API calls 69936->69942 69945 fe5024 69936->69945 69939 fe46c2 69937->69939 69938 fe519c 70148 ff25c0 ExitProcess RtlAllocateHeap RtlFreeHeap 69938->70148 69946 1072f00 3 API calls 69939->69946 69944 fe4f0c 69942->69944 69943 fe51aa 69954 1072f00 3 API calls 69944->69954 69945->69938 69949 ff9b50 4 API calls 69945->69949 69947 fe46d6 69946->69947 69950 f92660 3 API calls 69947->69950 69948 fe39d2 69951 fe39ea 69948->69951 70058 f9c010 69948->70058 69952 fe50b1 69949->69952 69960 fe46e9 69950->69960 69957 fe4669 69951->69957 69963 fe405c 69951->69963 70066 ffa1b0 69951->70066 69959 1072f00 3 API calls 69952->69959 69956 fe4f20 69954->69956 69958 f92660 3 API calls 69956->69958 69961 f92660 3 API calls 69957->69961 69970 fe4f33 69958->69970 69964 fe50c5 69959->69964 69960->69936 70046 f92be0 69960->70046 69961->69934 69962 fe4648 69962->69957 69969 f9c050 13 API calls 69962->69969 69963->69962 69966 ffa1b0 4 API calls 69963->69966 69968 f92660 3 API calls 69964->69968 70044 fe4088 69966->70044 69967 fe404d 70094 fac300 ExitProcess RtlAllocateHeap RtlFreeHeap 69967->70094 69975 fe50d8 69968->69975 69969->69957 69970->69945 69972 f92be0 6 API calls 69970->69972 69996 fe4f4c 69972->69996 69973 fe4702 69976 ffa1b0 4 API calls 69973->69976 69982 fe4ab8 69973->69982 69974 fe4639 70097 fac300 ExitProcess RtlAllocateHeap RtlFreeHeap 69974->70097 69975->69938 69978 f92be0 6 API calls 69975->69978 70024 fe4728 69976->70024 69977 fe501e 69980 1076788 7 API calls 69977->69980 69992 fe50f1 69978->69992 69980->69945 69981 fe4e88 69983 1076788 7 API calls 69981->69983 69982->69981 70100 ffd110 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 69982->70100 69983->69936 69985 fe5196 69988 1076788 7 API calls 69985->69988 69986 fe4adf 70101 1009be0 69986->70101 69988->69938 69989 fe4aa9 70099 fac300 ExitProcess RtlAllocateHeap RtlFreeHeap 69989->70099 69992->69985 69997 f92be0 6 API calls 69992->69997 69996->69977 69999 f92be0 6 API calls 69996->69999 69997->69992 69999->69996 70000 ff2b60 4 API calls 70000->70044 70001 f92700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70040 fe3a1a 70001->70040 70003 ff2b60 4 API calls 70003->70024 70006 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70006->70044 70007 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70007->70040 70009 1000ef0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70009->70040 70010 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70010->70024 70012 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70012->70044 70013 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70013->70024 70014 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 70014->70040 70015 1000ef0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70015->70044 70017 f9c010 10 API calls 70017->70040 70018 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70018->70040 70019 1000ef0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70019->70024 70020 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 70020->70024 70024->69989 70024->70003 70024->70010 70024->70013 70024->70019 70024->70020 70026 f92be0 6 API calls 70024->70026 70098 ff7330 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 70024->70098 70026->70024 70027 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70027->70044 70028 ff9c10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70028->70044 70030 ff9c10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70030->70040 70032 1072f00 ExitProcess RtlAllocateHeap RtlFreeHeap 70032->70040 70034 f9bf00 7 API calls 70034->70044 70035 f92be0 6 API calls 70035->70040 70036 f9bf90 10 API calls 70036->70044 70037 f9bf90 10 API calls 70037->70040 70038 f9c010 10 API calls 70038->70044 70039 1072f00 ExitProcess RtlAllocateHeap RtlFreeHeap 70039->70044 70040->69967 70040->70001 70040->70007 70040->70009 70040->70014 70040->70017 70040->70018 70040->70030 70040->70032 70040->70035 70040->70037 70041 1076788 7 API calls 70040->70041 70071 ff7330 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 70040->70071 70072 ff2b60 70040->70072 70083 f9c730 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70040->70083 70084 ff8730 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::locale::_Init 70040->70084 70085 f9bf00 70040->70085 70041->70040 70042 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 70042->70044 70043 f92be0 6 API calls 70043->70044 70044->69974 70044->70000 70044->70006 70044->70012 70044->70015 70044->70027 70044->70028 70044->70034 70044->70036 70044->70038 70044->70039 70044->70042 70044->70043 70045 1076788 7 API calls 70044->70045 70095 ff7330 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 70044->70095 70096 ff8730 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::locale::_Init 70044->70096 70045->70044 70149 f92bb0 70046->70149 70050 106c3b3 GetSystemTimePreciseAsFileTime 70049->70050 70051 f9bfa2 70050->70051 70052 f9bffe 70051->70052 70053 f9bfa9 70051->70053 70258 106c05c 8 API calls std::locale::_Setgloballocale 70052->70258 70056 f9bfbd GetFileAttributesA 70053->70056 70057 f9bfc9 __Mtx_unlock 70053->70057 70056->70057 70057->69948 70059 106c3b3 GetSystemTimePreciseAsFileTime 70058->70059 70060 f9c01d 70059->70060 70061 f9c03f 70060->70061 70062 f9c024 CreateDirectoryA 70060->70062 70259 106c05c 8 API calls std::locale::_Setgloballocale 70061->70259 70064 f9c038 __Mtx_unlock 70062->70064 70064->69951 70067 106ce31 std::_Facet_Register 4 API calls 70066->70067 70068 ffa1f4 70067->70068 70069 1009be0 4 API calls 70068->70069 70070 ffa21e 70069->70070 70070->70040 70071->70040 70073 ff2bbc 70072->70073 70078 ff2b85 Concurrency::cancel_current_task 70072->70078 70074 f92700 4 API calls 70073->70074 70075 ff2bc9 70074->70075 70260 f98740 4 API calls 2 library calls 70075->70260 70076 ff2b95 70076->70040 70078->70076 70079 f92700 4 API calls 70078->70079 70080 ff2bff 70079->70080 70261 f98740 4 API calls 2 library calls 70080->70261 70082 ff2c17 Concurrency::cancel_current_task 70083->70040 70084->70040 70086 f9bf10 70085->70086 70087 1072f00 3 API calls 70086->70087 70088 f9bf37 70087->70088 70089 1076788 7 API calls 70088->70089 70091 f9bf44 70088->70091 70089->70091 70090 f9bf73 70090->70040 70091->70090 70092 1072350 3 API calls 70091->70092 70093 f9bf89 70092->70093 70094->69963 70095->70044 70096->70044 70097->69962 70098->70024 70099->69982 70100->69986 70102 1009dd6 70101->70102 70103 1009c1f 70101->70103 70148->69943 70150 f92bc2 70149->70150 70153 107a413 70150->70153 70154 107a427 __fread_nolock 70153->70154 70155 107a449 70154->70155 70157 107a470 70154->70157 70166 10722c3 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock __Getctype 70155->70166 70162 1077a76 70157->70162 70158 107a464 70160 107207c __fread_nolock 3 API calls 70158->70160 70161 f92bcc 70160->70161 70161->69973 70163 1077a82 __fread_nolock 70162->70163 70167 10789ab 70163->70167 70166->70158 70176 10861e3 70167->70176 70169 10789d2 70200 10861a5 70176->70200 70178 1086256 70178->70169 70179 10861f4 70179->70178 70208 10849cd RtlAllocateHeap __Getctype std::_Facet_Register 70179->70208 70181 108624d 70203 10861b1 70200->70203 70201 10861df 70201->70179 70202 10861db 70202->70179 70203->70201 70203->70202 70204 1083b22 __fread_nolock 3 API calls 70203->70204 70205 10861cc 70204->70205 70206 108e8e4 __fread_nolock 3 API calls 70205->70206 70207 10861d2 70206->70207 70207->70179 70208->70181 70260->70078 70261->70082 70285 fe52b0 70581 fe52f3 __Mtx_unlock 70285->70581 70286 fe530b 70287 ff9b50 4 API calls 70286->70287 70289 fe7424 70287->70289 70288 ff9b50 4 API calls 70288->70581 70290 f9bf90 10 API calls 70289->70290 70291 fe743d 70290->70291 70292 fe744e CreateDirectoryA 70291->70292 70295 fe745d 70291->70295 70293 fe8053 70292->70293 70292->70295 70297 f92660 3 API calls 70293->70297 70294 fe8038 70294->70293 70298 f9c050 13 API calls 70294->70298 70295->70294 70296 ffa1b0 4 API calls 70295->70296 70484 fe7485 __Mtx_unlock 70296->70484 70299 fe8061 70297->70299 70298->70293 70300 ffa1b0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70300->70581 70301 fe8029 70642 fac300 ExitProcess RtlAllocateHeap RtlFreeHeap 70301->70642 70304 fe82c7 70306 1072350 3 API calls 70304->70306 70305 f9c050 13 API calls 70305->70581 70307 fe82cc 70306->70307 70644 106c05c 8 API calls std::locale::_Setgloballocale 70307->70644 70308 ffbe70 ExitProcess RtlAllocateHeap RtlFreeHeap 70308->70581 70310 fe82d2 70311 f92040 4 API calls 70310->70311 70312 fe82d7 70311->70312 70313 1072350 3 API calls 70312->70313 70317 fe82dc 70313->70317 70314 ff2a50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70314->70484 70315 ff2a50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70315->70581 70316 ffa1b0 4 API calls 70316->70484 70319 fe83b8 70317->70319 70320 fea497 70317->70320 70318 ff2b60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70318->70581 70322 ffd850 4 API calls 70319->70322 70324 f92040 4 API calls 70320->70324 70321 106ce31 std::_Facet_Register 4 API calls 70321->70581 70325 fe83e1 70322->70325 70323 ffbe70 3 API calls 70323->70484 70326 fea49c 70324->70326 70328 106c3b3 GetSystemTimePreciseAsFileTime 70325->70328 70645 106c05c 8 API calls std::locale::_Setgloballocale 70326->70645 70327 1009be0 4 API calls 70327->70581 70331 fe840e 70328->70331 70330 fea4a2 70646 106c05c 8 API calls std::locale::_Setgloballocale 70330->70646 70331->70326 70333 fe8419 70331->70333 70335 fe8439 __Mtx_unlock 70333->70335 70341 fe842d GetFileAttributesA 70333->70341 70339 106c3b3 GetSystemTimePreciseAsFileTime 70335->70339 70351 fe8453 __Mtx_unlock 70335->70351 70338 fe82ae Concurrency::cancel_current_task 70345 f92040 4 API calls 70338->70345 70342 fe848d 70339->70342 70341->70335 70341->70351 70342->70330 70347 fe8498 CreateDirectoryA 70342->70347 70344 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70344->70581 70345->70304 70346 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70346->70484 70347->70351 70364 106ce31 std::_Facet_Register 4 API calls 70351->70364 70376 fe9303 70351->70376 70397 fe92db 70351->70397 70353 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 70353->70581 70354 ff5b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70354->70484 70356 fe81fa Concurrency::cancel_current_task 70357 f92040 4 API calls 70356->70357 70362 fe8213 70357->70362 70359 106c3b3 GetSystemTimePreciseAsFileTime 70359->70484 70360 f92700 4 API calls 70360->70484 70361 f9c050 13 API calls 70361->70376 70643 106c05c 8 API calls std::locale::_Setgloballocale 70362->70643 70363 f92700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70363->70581 70368 fe850e 70364->70368 70367 ff9c10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70367->70484 70371 1009be0 4 API calls 70368->70371 70370 fe8219 70373 f92040 4 API calls 70370->70373 70584 fe8537 __Mtx_unlock 70371->70584 70377 fe821e 70373->70377 70374 1072f00 3 API calls 70374->70484 70381 fe9398 70376->70381 70382 fea4e3 70376->70382 70394 f92700 4 API calls 70377->70394 70379 ff5b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70379->70581 70380 f9bf90 10 API calls 70380->70484 70387 ffd850 4 API calls 70381->70387 70386 f92040 4 API calls 70382->70386 70383 ff5b90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70383->70581 70392 fea4e8 70386->70392 70393 fe93be 70387->70393 70388 106c3b3 GetSystemTimePreciseAsFileTime 70388->70581 70391 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70391->70484 70402 fe822f 70394->70402 70395 ff9c10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70395->70581 70397->70361 70397->70376 70408 ff9c70 4 API calls 70402->70408 70403 ffd660 4 API calls 70403->70484 70407 1072f00 ExitProcess RtlAllocateHeap RtlFreeHeap 70407->70581 70413 fe8244 70408->70413 70412 f9bf90 10 API calls 70412->70581 70416 f98920 4 API calls 70413->70416 70430 fe825c Concurrency::cancel_current_task 70416->70430 70419 ff5b90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70419->70484 70420 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70420->70581 70427 ffd660 4 API calls 70427->70581 70429 f9c010 10 API calls 70429->70581 70435 f92700 4 API calls 70430->70435 70434 ff2b60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70434->70484 70438 fe8281 70435->70438 70436 1076788 7 API calls 70436->70484 70441 ff9c70 4 API calls 70438->70441 70446 fe8296 70441->70446 70449 f98920 4 API calls 70446->70449 70449->70338 70451 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 70451->70484 70457 1076788 7 API calls 70457->70581 70463 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70463->70484 70470 1000ef0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70470->70484 70483 f92be0 6 API calls 70483->70484 70484->70301 70484->70304 70484->70307 70484->70310 70484->70312 70484->70314 70484->70316 70484->70323 70484->70338 70484->70346 70484->70354 70484->70359 70484->70360 70484->70367 70484->70374 70484->70380 70484->70391 70484->70403 70484->70419 70484->70434 70484->70436 70484->70451 70484->70463 70484->70470 70484->70483 70487 1000ef0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70487->70581 70490 1000850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70490->70581 70524 fe816a 70542 f92700 4 API calls 70524->70542 70544 fe817b 70542->70544 70548 ff9c70 4 API calls 70544->70548 70551 fe8190 70548->70551 70556 f98920 4 API calls 70551->70556 70554 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70554->70581 70560 fe81a8 Concurrency::cancel_current_task 70556->70560 70563 f92700 4 API calls 70560->70563 70565 fe81cd 70563->70565 70567 ff9c70 4 API calls 70565->70567 70569 fe81e2 70567->70569 70570 f98920 4 API calls 70569->70570 70570->70356 70581->70286 70581->70288 70581->70300 70581->70304 70581->70305 70581->70308 70581->70315 70581->70318 70581->70321 70581->70327 70581->70344 70581->70353 70581->70356 70581->70362 70581->70363 70581->70370 70581->70377 70581->70379 70581->70383 70581->70388 70581->70395 70581->70407 70581->70412 70581->70420 70581->70427 70581->70429 70581->70430 70581->70457 70581->70487 70581->70490 70581->70524 70581->70554 70581->70560 70583 f92be0 6 API calls 70581->70583 70635 ff9dd0 70581->70635 70638 ff9bb0 70581->70638 70641 fac300 ExitProcess RtlAllocateHeap RtlFreeHeap 70581->70641 70583->70581 70636 ffd660 4 API calls 70635->70636 70637 ff9de8 70636->70637 70637->70581 70639 ff5b20 4 API calls 70638->70639 70640 ff9bc6 70639->70640 70640->70581 70641->70581 70642->70294 70668 fe3350 70679 fe3376 70668->70679 70669 fe38f6 70670 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70670->70679 70674 ff3910 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70674->70679 70675 ff3510 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70675->70679 70677 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70677->70679 70679->70669 70679->70670 70679->70674 70679->70675 70679->70677 70680 fc48e0 70679->70680 70785 fc6590 70679->70785 70879 fc7660 70679->70879 70976 fc8c90 70679->70976 71064 fca700 70679->71064 70681 fc4916 70680->70681 71155 ff3c80 70681->71155 70684 ff3c50 4 API calls 70685 fc4960 70684->70685 70686 ff9ec0 4 API calls 70685->70686 70687 fc4985 __fread_nolock 70686->70687 70688 ff9c10 4 API calls 70687->70688 70689 fc49d0 70688->70689 70690 ff9b50 4 API calls 70689->70690 70691 fc4a22 70690->70691 71158 4d90c5b 70691->71158 71162 4d90c3a 70691->71162 71166 4d90b9b 70691->71166 71170 4d90e7f 70691->71170 71173 4d90e5c 70691->71173 71177 4d90d9e 70691->71177 71181 4d90c9e 70691->71181 71185 4d90cf6 70691->71185 71189 4d90cb7 70691->71189 71193 4d90c89 70691->71193 71197 4d90df6 70691->71197 71201 4d90e0d 70691->71201 71205 4d90dc9 70691->71205 71209 4d90c20 70691->71209 71213 4d90d4f 70691->71213 71217 4d90d46 70691->71217 71221 4d90c03 70691->71221 71225 4d90e26 70691->71225 71229 4d90e46 70691->71229 71233 4d90ba6 70691->71233 71238 4d90d7b 70691->71238 70693 1072350 3 API calls 70695 fc6495 70693->70695 70694 fc6330 70694->70693 70696 fc646d 70694->70696 70697 f92700 4 API calls 70695->70697 70696->70679 70698 fc64ac 70697->70698 70699 ff9c70 4 API calls 70698->70699 70700 fc64c1 70699->70700 70701 f98920 4 API calls 70700->70701 70703 fc64d9 Concurrency::cancel_current_task 70701->70703 70702 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 70728 fc4a46 __fread_nolock __Mtx_unlock 70702->70728 70704 f92700 4 API calls 70703->70704 70705 fc6504 70704->70705 70706 ff9c70 4 API calls 70705->70706 70707 fc6519 70706->70707 70708 f98920 4 API calls 70707->70708 70709 fc6531 Concurrency::cancel_current_task 70708->70709 71389 106c05c 8 API calls std::locale::_Setgloballocale 70709->71389 70711 fc654b 70713 f92040 4 API calls 70711->70713 70712 ff5e10 4 API calls 70712->70728 70715 fc6550 70713->70715 70717 fa4540 14 API calls 70717->70728 70719 fa4970 10 API calls 70719->70728 70721 102f8f0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70721->70728 70722 ff2b60 4 API calls 70722->70728 70723 ffd850 4 API calls 70723->70728 70724 102f0e0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70724->70728 70725 106c3b3 GetSystemTimePreciseAsFileTime 70725->70728 70726 ff3c80 4 API calls 70726->70728 70728->70694 70728->70695 70728->70702 70728->70703 70728->70709 70728->70711 70728->70712 70728->70717 70728->70719 70728->70721 70728->70722 70728->70723 70728->70724 70728->70725 70728->70726 70729 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70729 70730 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70730 70731 ff9d70 4 API calls 70728->70731 70732 ffa750 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70732 70733 ff9bb0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70733 70734 ff3910 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70734 70735 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70735 70736 f9bf90 10 API calls 70728->70736 70737 ff9c70 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70737 70738 f9bf00 7 API calls 70728->70738 70739 ffcfd0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70739 70740 ff9b50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70740 70741 1072f00 ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70741 70742 f92700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70742 70743 ffa000 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70743 70744 106ce31 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 70728->70744 70745 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70745 70746 1076788 7 API calls 70728->70746 70747 ff3640 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70747 70748 107ad08 6 API calls 70728->70748 70749 ff2a50 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70728->70749 71242 107a68e 70728->71242 71252 4d403c1 70728->71252 71256 4d40348 70728->71256 71260 4d4046a 70728->71260 71264 4d4039b 70728->71264 71268 4d404c9 70728->71268 71272 4d403f7 70728->71272 71276 4d40411 70728->71276 71280 4d40502 70728->71280 71284 4d4044e 70728->71284 71288 4d403e5 70728->71288 71292 4d40377 70728->71292 71296 4d40359 70728->71296 71301 4d40386 70728->71301 71305 4d404a0 70728->71305 71309 10528f0 70728->71309 71312 ffa860 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 70728->71312 71313 102efd0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70728->71313 71314 f9b8e0 70728->71314 71382 ffa250 70728->71382 70729->70728 70730->70728 70731->70728 70732->70728 70733->70728 70734->70728 70735->70728 70736->70728 70737->70728 70738->70728 70739->70728 70740->70728 70741->70728 70742->70728 70743->70728 70744->70728 70745->70728 70746->70728 70747->70728 70748->70728 70749->70728 70786 fc65c6 70785->70786 70787 ff7810 4 API calls 70786->70787 70788 fc65eb 70787->70788 70789 ff3c50 4 API calls 70788->70789 70790 fc6610 70789->70790 70791 ff9ec0 4 API calls 70790->70791 70792 fc664c __fread_nolock 70791->70792 70792->70792 70793 fc7590 70792->70793 70795 ffd850 4 API calls 70792->70795 70794 f92040 4 API calls 70793->70794 70796 fc7595 70794->70796 70798 fc66ef 70795->70798 70797 f92040 4 API calls 70796->70797 70813 fc74bc 70797->70813 70798->70796 70798->70798 70801 ffd850 4 API calls 70798->70801 70799 1072350 3 API calls 70800 fc759f 70799->70800 70803 f92700 4 API calls 70800->70803 70802 fc677f 70801->70802 70858 4d90c5b GetPrivateProfileStringA 70802->70858 70859 4d90d7b GetPrivateProfileStringA 70802->70859 70860 4d90b9b GetPrivateProfileStringA 70802->70860 70861 4d90c3a GetPrivateProfileStringA 70802->70861 70862 4d90e5c GetPrivateProfileStringA 70802->70862 70863 4d90e7f GetPrivateProfileStringA 70802->70863 70864 4d90c9e GetPrivateProfileStringA 70802->70864 70865 4d90d9e GetPrivateProfileStringA 70802->70865 70866 4d90cb7 GetPrivateProfileStringA 70802->70866 70867 4d90cf6 GetPrivateProfileStringA 70802->70867 70868 4d90df6 GetPrivateProfileStringA 70802->70868 70869 4d90c89 GetPrivateProfileStringA 70802->70869 70870 4d90dc9 GetPrivateProfileStringA 70802->70870 70871 4d90e0d GetPrivateProfileStringA 70802->70871 70872 4d90d4f GetPrivateProfileStringA 70802->70872 70873 4d90c20 GetPrivateProfileStringA 70802->70873 70874 4d90c03 GetPrivateProfileStringA 70802->70874 70875 4d90d46 GetPrivateProfileStringA 70802->70875 70876 4d90e46 GetPrivateProfileStringA 70802->70876 70877 4d90e26 GetPrivateProfileStringA 70802->70877 70878 4d90ba6 GetPrivateProfileStringA 70802->70878 70804 fc75b6 70803->70804 70805 ff9c70 4 API calls 70804->70805 70806 fc75cb 70805->70806 70807 f98920 4 API calls 70806->70807 70809 fc75e3 Concurrency::cancel_current_task 70807->70809 70808 107a68e 4 API calls 70843 fc67b1 __fread_nolock 70808->70843 70810 f92700 4 API calls 70809->70810 70811 fc760b 70810->70811 70812 ff9c70 4 API calls 70811->70812 70814 fc7620 70812->70814 70813->70799 70815 fc756d 70813->70815 70816 f98920 4 API calls 70814->70816 70815->70679 70817 fc7638 Concurrency::cancel_current_task 70816->70817 70818 ff5b20 4 API calls 70818->70843 70819 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70819->70843 70820 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70820->70843 70821 1072f00 3 API calls 70821->70843 70822 f9c430 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70822->70843 70823 1076788 7 API calls 70823->70843 70824 ff59f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70824->70843 70825 ff8000 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70825->70843 70826 ff3c50 4 API calls 70826->70843 70827 106ce31 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 70827->70843 70829 fa4540 14 API calls 70829->70843 70830 10527b0 3 API calls 70830->70843 70831 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70831->70843 70832 fa4970 10 API calls 70832->70843 70833 102f0e0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70833->70843 70836 102bfb0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70836->70843 70837 101da80 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70837->70843 70838 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70838->70843 70839 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70839->70843 70840 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70840->70843 70841 ffcfd0 4 API calls 70841->70843 70843->70793 70843->70800 70843->70808 70843->70809 70843->70813 70843->70818 70843->70819 70843->70820 70843->70821 70843->70822 70843->70823 70843->70824 70843->70825 70843->70826 70843->70827 70843->70829 70843->70830 70843->70831 70843->70832 70843->70833 70843->70836 70843->70837 70843->70838 70843->70839 70843->70840 70843->70841 70844 4d403f7 BaseDllReadWriteIniFile 70843->70844 70845 4d40377 BaseDllReadWriteIniFile 70843->70845 70846 4d40411 BaseDllReadWriteIniFile 70843->70846 70847 4d40359 BaseDllReadWriteIniFile 70843->70847 70848 4d4039b BaseDllReadWriteIniFile 70843->70848 70849 4d403e5 BaseDllReadWriteIniFile 70843->70849 70850 4d40386 BaseDllReadWriteIniFile 70843->70850 70851 4d404a0 BaseDllReadWriteIniFile 70843->70851 70852 4d403c1 BaseDllReadWriteIniFile 70843->70852 70853 4d40502 BaseDllReadWriteIniFile 70843->70853 70854 4d4044e BaseDllReadWriteIniFile 70843->70854 70855 4d40348 BaseDllReadWriteIniFile 70843->70855 70856 4d404c9 BaseDllReadWriteIniFile 70843->70856 70857 4d4046a BaseDllReadWriteIniFile 70843->70857 71663 ff79e0 70843->71663 71675 ff3510 70843->71675 71691 102dee0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70843->71691 71692 102e0f0 RtlAllocateHeap RtlFreeHeap 70843->71692 70844->70843 70845->70843 70846->70843 70847->70843 70848->70843 70849->70843 70850->70843 70851->70843 70852->70843 70853->70843 70854->70843 70855->70843 70856->70843 70857->70843 70858->70843 70859->70843 70860->70843 70861->70843 70862->70843 70863->70843 70864->70843 70865->70843 70866->70843 70867->70843 70868->70843 70869->70843 70870->70843 70871->70843 70872->70843 70873->70843 70874->70843 70875->70843 70876->70843 70877->70843 70878->70843 70880 fc7696 70879->70880 70881 ff7810 4 API calls 70880->70881 70882 fc76bb 70881->70882 70883 ff3c50 4 API calls 70882->70883 70884 fc76e3 70883->70884 70885 ff9ec0 4 API calls 70884->70885 70886 fc7728 __fread_nolock 70885->70886 70886->70886 70887 fc8b8f 70886->70887 70888 ffd850 4 API calls 70886->70888 70889 f92040 4 API calls 70887->70889 70892 fc77e0 70888->70892 70890 fc8b94 70889->70890 70891 f92040 4 API calls 70890->70891 70911 fc8ab7 70891->70911 70892->70890 70892->70892 70897 ffd850 4 API calls 70892->70897 70893 1072350 3 API calls 70894 fc8b9e 70893->70894 71696 ff93d0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70894->71696 70896 fc8ba3 70899 f92700 4 API calls 70896->70899 70898 fc786f 70897->70898 70955 4d90c5b GetPrivateProfileStringA 70898->70955 70956 4d90d7b GetPrivateProfileStringA 70898->70956 70957 4d90b9b GetPrivateProfileStringA 70898->70957 70958 4d90c3a GetPrivateProfileStringA 70898->70958 70959 4d90e5c GetPrivateProfileStringA 70898->70959 70960 4d90e7f GetPrivateProfileStringA 70898->70960 70961 4d90c9e GetPrivateProfileStringA 70898->70961 70962 4d90d9e GetPrivateProfileStringA 70898->70962 70963 4d90cb7 GetPrivateProfileStringA 70898->70963 70964 4d90cf6 GetPrivateProfileStringA 70898->70964 70965 4d90df6 GetPrivateProfileStringA 70898->70965 70966 4d90c89 GetPrivateProfileStringA 70898->70966 70967 4d90dc9 GetPrivateProfileStringA 70898->70967 70968 4d90e0d GetPrivateProfileStringA 70898->70968 70969 4d90d4f GetPrivateProfileStringA 70898->70969 70970 4d90c20 GetPrivateProfileStringA 70898->70970 70971 4d90c03 GetPrivateProfileStringA 70898->70971 70972 4d90d46 GetPrivateProfileStringA 70898->70972 70973 4d90e46 GetPrivateProfileStringA 70898->70973 70974 4d90e26 GetPrivateProfileStringA 70898->70974 70975 4d90ba6 GetPrivateProfileStringA 70898->70975 70900 fc8bba 70899->70900 70901 ff9c70 4 API calls 70900->70901 70902 fc8bcf 70901->70902 70903 f98920 4 API calls 70902->70903 70905 fc8be7 Concurrency::cancel_current_task 70903->70905 70904 107a68e 4 API calls 70933 fc78a1 __fread_nolock 70904->70933 70906 f92700 4 API calls 70905->70906 70907 fc8c12 70906->70907 70908 ff9c70 4 API calls 70907->70908 70910 fc8c27 70908->70910 70909 fc8b6c 70909->70679 70912 f98920 4 API calls 70910->70912 70911->70893 70911->70909 70913 fc8c3f Concurrency::cancel_current_task 70912->70913 70914 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70914->70933 70915 ff5b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70915->70933 70916 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70916->70933 70917 1072f00 3 API calls 70917->70933 70918 f9c430 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70918->70933 70919 1076788 7 API calls 70919->70933 70920 ff8000 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70920->70933 70921 ff59f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70921->70933 70922 ff3c50 4 API calls 70922->70933 70923 106ce31 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 70923->70933 70924 ff79e0 4 API calls 70924->70933 70925 fa4540 14 API calls 70925->70933 70926 10527b0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70926->70933 70927 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70927->70933 70928 fa4970 10 API calls 70928->70933 70929 102f0e0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70929->70933 70932 102bfb0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70932->70933 70933->70887 70933->70894 70933->70896 70933->70904 70933->70905 70933->70911 70933->70914 70933->70915 70933->70916 70933->70917 70933->70918 70933->70919 70933->70920 70933->70921 70933->70922 70933->70923 70933->70924 70933->70925 70933->70926 70933->70927 70933->70928 70933->70929 70933->70932 70934 ff9c70 4 API calls 70933->70934 70935 101da80 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70933->70935 70936 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70933->70936 70937 ffcfd0 4 API calls 70933->70937 70938 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70933->70938 70939 ff3510 4 API calls 70933->70939 70940 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 70933->70940 70941 4d403f7 BaseDllReadWriteIniFile 70933->70941 70942 4d40377 BaseDllReadWriteIniFile 70933->70942 70943 4d40411 BaseDllReadWriteIniFile 70933->70943 70944 4d40359 BaseDllReadWriteIniFile 70933->70944 70945 4d4039b BaseDllReadWriteIniFile 70933->70945 70946 4d403e5 BaseDllReadWriteIniFile 70933->70946 70947 4d40386 BaseDllReadWriteIniFile 70933->70947 70948 4d404a0 BaseDllReadWriteIniFile 70933->70948 70949 4d403c1 BaseDllReadWriteIniFile 70933->70949 70950 4d40502 BaseDllReadWriteIniFile 70933->70950 70951 4d4044e BaseDllReadWriteIniFile 70933->70951 70952 4d40348 BaseDllReadWriteIniFile 70933->70952 70953 4d404c9 BaseDllReadWriteIniFile 70933->70953 70954 4d4046a BaseDllReadWriteIniFile 70933->70954 71694 102dee0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 70933->71694 71695 102e0f0 RtlAllocateHeap RtlFreeHeap 70933->71695 70934->70933 70935->70933 70936->70933 70937->70933 70938->70933 70939->70933 70940->70933 70941->70933 70942->70933 70943->70933 70944->70933 70945->70933 70946->70933 70947->70933 70948->70933 70949->70933 70950->70933 70951->70933 70952->70933 70953->70933 70954->70933 70955->70933 70956->70933 70957->70933 70958->70933 70959->70933 70960->70933 70961->70933 70962->70933 70963->70933 70964->70933 70965->70933 70966->70933 70967->70933 70968->70933 70969->70933 70970->70933 70971->70933 70972->70933 70973->70933 70974->70933 70975->70933 70977 fc8cc6 70976->70977 70978 ff7810 4 API calls 70977->70978 70979 fc8ceb 70978->70979 70980 ff3c50 4 API calls 70979->70980 70981 fc8d13 70980->70981 70982 ff9ec0 4 API calls 70981->70982 70983 fc8d4d __fread_nolock 70982->70983 70983->70983 70984 fca68a 70983->70984 70985 ffd850 4 API calls 70983->70985 70986 f92040 4 API calls 70984->70986 70989 fc8e05 70985->70989 70987 fca68f 70986->70987 70988 f92040 4 API calls 70987->70988 71002 fca5b6 70988->71002 70989->70987 70989->70989 70992 ffd850 4 API calls 70989->70992 70990 1072350 3 API calls 70991 fca699 70990->70991 70994 f92700 4 API calls 70991->70994 70993 fc8e98 70992->70993 71043 4d90c5b GetPrivateProfileStringA 70993->71043 71044 4d90d7b GetPrivateProfileStringA 70993->71044 71045 4d90b9b GetPrivateProfileStringA 70993->71045 71046 4d90c3a GetPrivateProfileStringA 70993->71046 71047 4d90e5c GetPrivateProfileStringA 70993->71047 71048 4d90e7f GetPrivateProfileStringA 70993->71048 71049 4d90c9e GetPrivateProfileStringA 70993->71049 71050 4d90d9e GetPrivateProfileStringA 70993->71050 71051 4d90cb7 GetPrivateProfileStringA 70993->71051 71052 4d90cf6 GetPrivateProfileStringA 70993->71052 71053 4d90df6 GetPrivateProfileStringA 70993->71053 71054 4d90c89 GetPrivateProfileStringA 70993->71054 71055 4d90dc9 GetPrivateProfileStringA 70993->71055 71056 4d90e0d GetPrivateProfileStringA 70993->71056 71057 4d90d4f GetPrivateProfileStringA 70993->71057 71058 4d90c20 GetPrivateProfileStringA 70993->71058 71059 4d90c03 GetPrivateProfileStringA 70993->71059 71060 4d90d46 GetPrivateProfileStringA 70993->71060 71061 4d90e46 GetPrivateProfileStringA 70993->71061 71062 4d90e26 GetPrivateProfileStringA 70993->71062 71063 4d90ba6 GetPrivateProfileStringA 70993->71063 70995 fca6b0 70994->70995 70996 ff9c70 4 API calls 70995->70996 70997 fca6c5 70996->70997 70998 f98920 4 API calls 70997->70998 70999 fca6dd Concurrency::cancel_current_task 70998->70999 71000 107a68e 4 API calls 71028 fc8eca __fread_nolock 71000->71028 71001 fca667 71001->70679 71002->70990 71002->71001 71003 ff5b20 4 API calls 71003->71028 71004 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71004->71028 71005 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71005->71028 71006 f9c430 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71006->71028 71007 1072f00 3 API calls 71007->71028 71008 1076788 7 API calls 71008->71028 71009 ff59f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71009->71028 71010 ff8000 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71010->71028 71011 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71011->71028 71012 ff3c50 4 API calls 71012->71028 71013 ff79e0 4 API calls 71013->71028 71014 fa4540 14 API calls 71014->71028 71015 10527b0 3 API calls 71015->71028 71016 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71016->71028 71017 fa4970 10 API calls 71017->71028 71018 102f0e0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71018->71028 71021 102bfb0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71021->71028 71022 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71022->71028 71023 101da80 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71023->71028 71025 106ce31 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 71025->71028 71026 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71026->71028 71027 ff3510 4 API calls 71027->71028 71028->70984 71028->70991 71028->71000 71028->71002 71028->71003 71028->71004 71028->71005 71028->71006 71028->71007 71028->71008 71028->71009 71028->71010 71028->71011 71028->71012 71028->71013 71028->71014 71028->71015 71028->71016 71028->71017 71028->71018 71028->71021 71028->71022 71028->71023 71028->71025 71028->71026 71028->71027 71029 4d403f7 BaseDllReadWriteIniFile 71028->71029 71030 4d40377 BaseDllReadWriteIniFile 71028->71030 71031 4d40411 BaseDllReadWriteIniFile 71028->71031 71032 4d40359 BaseDllReadWriteIniFile 71028->71032 71033 4d4039b BaseDllReadWriteIniFile 71028->71033 71034 4d403e5 BaseDllReadWriteIniFile 71028->71034 71035 4d40386 BaseDllReadWriteIniFile 71028->71035 71036 4d404a0 BaseDllReadWriteIniFile 71028->71036 71037 4d403c1 BaseDllReadWriteIniFile 71028->71037 71038 4d40502 BaseDllReadWriteIniFile 71028->71038 71039 4d4044e BaseDllReadWriteIniFile 71028->71039 71040 4d40348 BaseDllReadWriteIniFile 71028->71040 71041 4d404c9 BaseDllReadWriteIniFile 71028->71041 71042 4d4046a BaseDllReadWriteIniFile 71028->71042 71697 107a9d6 71028->71697 71703 102dee0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71028->71703 71704 102e0f0 RtlAllocateHeap RtlFreeHeap 71028->71704 71029->71028 71030->71028 71031->71028 71032->71028 71033->71028 71034->71028 71035->71028 71036->71028 71037->71028 71038->71028 71039->71028 71040->71028 71041->71028 71042->71028 71043->71028 71044->71028 71045->71028 71046->71028 71047->71028 71048->71028 71049->71028 71050->71028 71051->71028 71052->71028 71053->71028 71054->71028 71055->71028 71056->71028 71057->71028 71058->71028 71059->71028 71060->71028 71061->71028 71062->71028 71063->71028 71065 fca736 71064->71065 71066 ff7810 4 API calls 71065->71066 71067 fca75b 71066->71067 71068 ff3c50 4 API calls 71067->71068 71069 fca783 71068->71069 71070 ff9ec0 4 API calls 71069->71070 71072 fca7bc __fread_nolock 71070->71072 71071 fcb98f 71073 f92040 4 API calls 71071->71073 71072->71071 71074 ffd850 4 API calls 71072->71074 71075 fcb994 71073->71075 71078 fca874 71074->71078 71076 f92040 4 API calls 71075->71076 71091 fcb8bb 71076->71091 71077 1072350 3 API calls 71079 fcb99e 71077->71079 71078->71075 71078->71078 71080 ffd850 4 API calls 71078->71080 71081 f92700 4 API calls 71079->71081 71082 fca8ff 71080->71082 71083 fcb9b5 71081->71083 71120 4d90c5b GetPrivateProfileStringA 71082->71120 71121 4d90d7b GetPrivateProfileStringA 71082->71121 71122 4d90b9b GetPrivateProfileStringA 71082->71122 71123 4d90c3a GetPrivateProfileStringA 71082->71123 71124 4d90e5c GetPrivateProfileStringA 71082->71124 71125 4d90e7f GetPrivateProfileStringA 71082->71125 71126 4d90c9e GetPrivateProfileStringA 71082->71126 71127 4d90d9e GetPrivateProfileStringA 71082->71127 71128 4d90cb7 GetPrivateProfileStringA 71082->71128 71129 4d90cf6 GetPrivateProfileStringA 71082->71129 71130 4d90df6 GetPrivateProfileStringA 71082->71130 71131 4d90c89 GetPrivateProfileStringA 71082->71131 71132 4d90dc9 GetPrivateProfileStringA 71082->71132 71133 4d90e0d GetPrivateProfileStringA 71082->71133 71134 4d90d4f GetPrivateProfileStringA 71082->71134 71135 4d90c20 GetPrivateProfileStringA 71082->71135 71136 4d90c03 GetPrivateProfileStringA 71082->71136 71137 4d90d46 GetPrivateProfileStringA 71082->71137 71138 4d90e46 GetPrivateProfileStringA 71082->71138 71139 4d90e26 GetPrivateProfileStringA 71082->71139 71140 4d90ba6 GetPrivateProfileStringA 71082->71140 71084 ff9c70 4 API calls 71083->71084 71085 fcb9ca 71084->71085 71086 f98920 4 API calls 71085->71086 71088 fcb9e2 Concurrency::cancel_current_task 71086->71088 71087 107a68e 4 API calls 71119 fca931 __fread_nolock __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 71087->71119 71089 fcba3e LoadLibraryA 71088->71089 71093 fcba5c 71088->71093 71089->71093 71090 fcb96c 71090->70679 71091->71077 71091->71090 71092 ff5b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71092->71119 71093->70679 71093->71093 71094 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71094->71119 71095 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71095->71119 71096 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71096->71119 71097 1072f00 3 API calls 71097->71119 71098 f9c430 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71098->71119 71099 ff8000 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71099->71119 71100 1076788 7 API calls 71100->71119 71101 ff59f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71101->71119 71102 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71102->71119 71103 ff3c50 4 API calls 71103->71119 71104 ff79e0 4 API calls 71104->71119 71105 fa4540 14 API calls 71105->71119 71106 10527b0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71106->71119 71107 fa4970 10 API calls 71107->71119 71110 101da80 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71110->71119 71111 ff9c70 4 API calls 71111->71119 71112 102f0e0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71112->71119 71113 102bfb0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71113->71119 71114 106ce31 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 71114->71119 71115 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71115->71119 71116 107a9d6 4 API calls 71116->71119 71117 ff3510 4 API calls 71117->71119 71118 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71118->71119 71119->71071 71119->71079 71119->71087 71119->71091 71119->71092 71119->71094 71119->71095 71119->71096 71119->71097 71119->71098 71119->71099 71119->71100 71119->71101 71119->71102 71119->71103 71119->71104 71119->71105 71119->71106 71119->71107 71119->71110 71119->71111 71119->71112 71119->71113 71119->71114 71119->71115 71119->71116 71119->71117 71119->71118 71141 4d403f7 BaseDllReadWriteIniFile 71119->71141 71142 4d40377 BaseDllReadWriteIniFile 71119->71142 71143 4d40411 BaseDllReadWriteIniFile 71119->71143 71144 4d40359 BaseDllReadWriteIniFile 71119->71144 71145 4d4039b BaseDllReadWriteIniFile 71119->71145 71146 4d403e5 BaseDllReadWriteIniFile 71119->71146 71147 4d40386 BaseDllReadWriteIniFile 71119->71147 71148 4d404a0 BaseDllReadWriteIniFile 71119->71148 71149 4d403c1 BaseDllReadWriteIniFile 71119->71149 71150 4d40502 BaseDllReadWriteIniFile 71119->71150 71151 4d4044e BaseDllReadWriteIniFile 71119->71151 71152 4d40348 BaseDllReadWriteIniFile 71119->71152 71153 4d404c9 BaseDllReadWriteIniFile 71119->71153 71154 4d4046a BaseDllReadWriteIniFile 71119->71154 71733 102dee0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71119->71733 71734 102e0f0 RtlAllocateHeap RtlFreeHeap 71119->71734 71120->71119 71121->71119 71122->71119 71123->71119 71124->71119 71125->71119 71126->71119 71127->71119 71128->71119 71129->71119 71130->71119 71131->71119 71132->71119 71133->71119 71134->71119 71135->71119 71136->71119 71137->71119 71138->71119 71139->71119 71140->71119 71141->71119 71142->71119 71143->71119 71144->71119 71145->71119 71146->71119 71147->71119 71148->71119 71149->71119 71150->71119 71151->71119 71152->71119 71153->71119 71154->71119 71156 ff7810 4 API calls 71155->71156 71157 fc4937 71156->71157 71157->70684 71159 4d90c4b GetPrivateProfileStringA 71158->71159 71161 4d90eaa 71159->71161 71161->70728 71163 4d90c3e GetPrivateProfileStringA 71162->71163 71165 4d90eaa 71163->71165 71165->70728 71167 4d90bb6 GetPrivateProfileStringA 71166->71167 71169 4d90eaa 71167->71169 71169->70728 71171 4d90e86 GetPrivateProfileStringA 71170->71171 71172 4d90eaa 71171->71172 71172->70728 71174 4d90e4c GetPrivateProfileStringA 71173->71174 71176 4d90eaa 71174->71176 71176->70728 71178 4d90dad GetPrivateProfileStringA 71177->71178 71180 4d90eaa 71178->71180 71180->70728 71182 4d90c4b GetPrivateProfileStringA 71181->71182 71184 4d90eaa 71182->71184 71184->70728 71186 4d90d0d GetPrivateProfileStringA 71185->71186 71188 4d90eaa 71186->71188 71188->70728 71190 4d90cec GetPrivateProfileStringA 71189->71190 71192 4d90eaa 71190->71192 71192->70728 71194 4d90c4b GetPrivateProfileStringA 71193->71194 71196 4d90eaa 71194->71196 71196->70728 71198 4d90d94 GetPrivateProfileStringA 71197->71198 71200 4d90eaa 71198->71200 71200->70728 71202 4d90dde GetPrivateProfileStringA 71201->71202 71204 4d90eaa 71202->71204 71204->70728 71206 4d90e01 GetPrivateProfileStringA 71205->71206 71208 4d90eaa 71206->71208 71208->70728 71210 4d90c3e GetPrivateProfileStringA 71209->71210 71212 4d90eaa 71210->71212 71212->70728 71214 4d90d5a GetPrivateProfileStringA 71213->71214 71216 4d90eaa 71214->71216 71216->70728 71218 4d90d53 GetPrivateProfileStringA 71217->71218 71220 4d90eaa 71218->71220 71220->70728 71222 4d90c2d GetPrivateProfileStringA 71221->71222 71224 4d90eaa 71222->71224 71224->70728 71226 4d90e35 GetPrivateProfileStringA 71225->71226 71228 4d90eaa 71226->71228 71228->70728 71230 4d90e6f GetPrivateProfileStringA 71229->71230 71232 4d90eaa 71230->71232 71232->70728 71234 4d90b67 71233->71234 71235 4d90ba9 GetPrivateProfileStringA 71233->71235 71234->70728 71237 4d90eaa 71235->71237 71237->70728 71239 4d90dad GetPrivateProfileStringA 71238->71239 71241 4d90eaa 71239->71241 71241->70728 71243 107a6e5 71242->71243 71244 107a69d 71242->71244 71392 107a6fb 4 API calls 2 library calls 71243->71392 71245 107a6a3 71244->71245 71248 107a6c0 71244->71248 71390 1072340 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock 71245->71390 71251 107a6de 71248->71251 71391 1072340 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock 71248->71391 71250 107a6b3 71250->70728 71251->70728 71253 4d403e7 BaseDllReadWriteIniFile 71252->71253 71255 4d4054e 71253->71255 71257 4d40369 BaseDllReadWriteIniFile 71256->71257 71259 4d4054e 71257->71259 71261 4d4046d BaseDllReadWriteIniFile 71260->71261 71263 4d4054e 71261->71263 71265 4d403cf BaseDllReadWriteIniFile 71264->71265 71267 4d4054e 71265->71267 71269 4d404e0 BaseDllReadWriteIniFile 71268->71269 71271 4d4054e 71269->71271 71273 4d40403 BaseDllReadWriteIniFile 71272->71273 71275 4d4054e 71273->71275 71277 4d40419 BaseDllReadWriteIniFile 71276->71277 71279 4d4054e 71277->71279 71281 4d4051d BaseDllReadWriteIniFile 71280->71281 71283 4d4054e 71281->71283 71285 4d40451 BaseDllReadWriteIniFile 71284->71285 71287 4d4054e 71285->71287 71289 4d40409 BaseDllReadWriteIniFile 71288->71289 71291 4d4054e 71289->71291 71293 4d40338 71292->71293 71293->71292 71294 4d40530 BaseDllReadWriteIniFile 71293->71294 71295 4d4054e 71294->71295 71297 4d40376 71296->71297 71298 4d403e8 BaseDllReadWriteIniFile 71296->71298 71297->70728 71300 4d4054e 71298->71300 71302 4d40391 BaseDllReadWriteIniFile 71301->71302 71304 4d4054e 71302->71304 71306 4d4046d BaseDllReadWriteIniFile 71305->71306 71308 4d4054e 71306->71308 71310 10527b0 3 API calls 71309->71310 71311 1052903 71310->71311 71311->70728 71312->70728 71313->70728 71315 f9b944 71314->71315 71315->71315 71316 1072f00 3 API calls 71315->71316 71317 f9b96b 71316->71317 71322 f9b9da 71317->71322 71393 1076cd6 71317->71393 71319 f9ba04 71319->70728 71322->71319 71324 1072350 3 API calls 71322->71324 71325 f9ba24 71324->71325 71383 ff7810 4 API calls 71382->71383 71384 ffa2a6 71383->71384 71572 ffc5a0 71384->71572 71390->71250 71391->71250 71392->71250 71394 1076ce9 __fread_nolock 71393->71394 71418 1076a2d 71394->71418 71573 ffca53 71572->71573 71579 ffc5ea 71572->71579 71643 1004680 71573->71643 71578 ff7810 4 API calls 71580 ffc6b8 71578->71580 71579->71578 71648 10046fe 71643->71648 71666 ff7a10 71663->71666 71664 ff7a4e 71667 106ce31 std::_Facet_Register 4 API calls 71664->71667 71665 ff7ac9 71693 f97d60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71665->71693 71666->71664 71666->71665 71672 ff7a94 71666->71672 71670 ff7a68 71667->71670 71669 ff7ace 71671 ff5e10 4 API calls 71670->71671 71673 ff7a82 71671->71673 71672->70843 71674 ff7810 4 API calls 71673->71674 71674->71672 71676 ff3535 71675->71676 71685 ff3568 71675->71685 71677 106ce31 std::_Facet_Register 4 API calls 71676->71677 71680 ff353f 71677->71680 71678 ff358a 71681 ff79e0 4 API calls 71678->71681 71679 ff35a8 71684 f92700 4 API calls 71679->71684 71683 106ce31 std::_Facet_Register 4 API calls 71680->71683 71682 ff3595 71681->71682 71682->70843 71683->71685 71686 ff35b8 71684->71686 71685->71678 71685->71679 71687 ff9c70 4 API calls 71686->71687 71688 ff35cd 71687->71688 71689 f98920 4 API calls 71688->71689 71690 ff35e2 Concurrency::cancel_current_task 71689->71690 71690->70843 71691->70843 71692->70843 71693->71669 71694->70933 71695->70933 71698 107a9ea __fread_nolock 71697->71698 71705 10775da 71698->71705 71700 107aa04 71701 107207c __fread_nolock 3 API calls 71700->71701 71703->71028 71704->71028 71721 1076559 71705->71721 71707 107761d 71707->71700 71708 1077635 71709 107765a 71708->71709 71727 10778b0 4 API calls 2 library calls 71708->71727 71728 1076574 4 API calls 2 library calls 71709->71728 71710 1077602 71726 10722c3 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock __Getctype 71710->71726 71711 10775ed 71711->71707 71711->71708 71711->71710 71722 1076571 71721->71722 71723 107655e 71721->71723 71722->71711 71732 1072340 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock 71723->71732 71725 107656e 71725->71711 71726->71707 71727->71709 71732->71725 71733->71119 71734->71119 71735 ffc4d0 71736 ffc4fd 71735->71736 71737 ffc4d7 71735->71737 71737->71736 71738 1072350 3 API calls 71737->71738 71739 ff8000 71738->71739 71740 ffb180 4 API calls 71739->71740 71742 ff804c 71739->71742 71741 ff8013 71740->71741 71741->71742 71743 1072350 3 API calls 71741->71743 71744 ff8074 71743->71744 71755 f93b70 4 API calls 2 library calls 71744->71755 71746 ff8121 71747 106ce31 std::_Facet_Register 4 API calls 71746->71747 71748 ff8128 71747->71748 71756 106bc3e 4 API calls 5 library calls 71748->71756 71750 ff813b 71757 ff95e0 5 API calls 4 library calls 71750->71757 71752 ff816e 71753 ff81b2 71752->71753 71758 f93b70 4 API calls 2 library calls 71752->71758 71755->71746 71756->71750 71757->71752 71758->71753 71759 1006570 71760 100657c 71759->71760 71763 10065bf 71759->71763 71761 ffb180 4 API calls 71760->71761 71762 1006586 71761->71762 71762->71763 71764 1072350 3 API calls 71762->71764 71765 10065f3 71764->71765 71766 4df06a5 71767 4df06d4 GetCurrentHwProfileW 71766->71767 71768 4df06ef 71767->71768 71769 fddb80 71792 fddbc2 71769->71792 71770 fdeea6 72288 fd0360 71770->72288 71773 ff9ec0 4 API calls 71774 fdeeec 71773->71774 71775 ff3910 4 API calls 71774->71775 71776 fdeef8 71775->71776 71777 ff9ec0 4 API calls 71776->71777 71778 fdef2f 71777->71778 71780 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71780->71792 71781 ff3910 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71781->71792 71783 ff3510 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71783->71792 71784 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71784->71792 71785 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71785->71792 71786 fb8570 17 API calls 71786->71792 71792->71770 71792->71780 71792->71781 71792->71783 71792->71784 71792->71785 71792->71786 71793 fdf0b0 15 API calls 71792->71793 71794 fb4730 71792->71794 71857 fb5a90 71792->71857 71995 fba760 71792->71995 72059 fbba60 71792->72059 72202 fc1010 71792->72202 72317 1001220 15 API calls 2 library calls 71792->72317 72318 ff2640 ExitProcess RtlAllocateHeap RtlFreeHeap 71792->72318 71793->71792 71795 ff7810 4 API calls 71794->71795 71796 fb478a 71795->71796 71797 ff3c50 4 API calls 71796->71797 71798 fb47af 71797->71798 71799 ff9ec0 4 API calls 71798->71799 71800 fb47f8 __fread_nolock 71799->71800 71800->71800 71801 fb5a27 71800->71801 71802 ffd850 4 API calls 71800->71802 71803 f92040 4 API calls 71801->71803 71804 fb48af 71802->71804 71833 fb492b 71803->71833 71805 fb48e1 71804->71805 71806 fb4d64 71804->71806 71808 ff5e10 4 API calls 71805->71808 71809 1002a00 4 API calls 71806->71809 71807 1072350 3 API calls 71810 fb5a31 71807->71810 71811 fb48f2 71808->71811 71815 fb4d62 71809->71815 71814 f92700 4 API calls 71810->71814 71812 fb0780 15 API calls 71811->71812 71813 fb48fd 71812->71813 71816 fb4923 71813->71816 71832 fb49e2 71813->71832 71817 fb5a45 71814->71817 71823 1002a00 4 API calls 71815->71823 71815->71833 71837 fb4e24 std::locale::_Init 71815->71837 71818 ff8000 5 API calls 71816->71818 71821 ff9c70 4 API calls 71817->71821 71818->71833 71819 fb5993 71825 ff8000 5 API calls 71819->71825 71820 fb4d53 71824 ff8000 5 API calls 71820->71824 71822 fb5a5a 71821->71822 71826 f98920 4 API calls 71822->71826 71823->71837 71824->71815 71825->71833 71828 fb5a72 Concurrency::cancel_current_task 71826->71828 71827 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71827->71837 71829 ff3c50 4 API calls 71829->71837 71830 fb49dd 71830->71792 71831 ffd850 4 API calls 71831->71832 71832->71801 71832->71820 71832->71831 71832->71833 71834 ff5b90 4 API calls 71832->71834 71835 fb0780 15 API calls 71832->71835 71836 ff8000 5 API calls 71832->71836 71840 ff5e10 4 API calls 71832->71840 72319 1002b20 4 API calls 2 library calls 71832->72319 71833->71807 71833->71830 71834->71832 71835->71832 71836->71832 71837->71801 71837->71810 71837->71819 71837->71827 71837->71829 71837->71833 71838 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71837->71838 71839 ffd660 4 API calls 71837->71839 71843 fa4540 14 API calls 71837->71843 71844 ff9ec0 4 API calls 71837->71844 71845 10527b0 3 API calls 71837->71845 71846 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71837->71846 71847 fa4970 10 API calls 71837->71847 71848 102f0e0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71837->71848 71851 102bfb0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71837->71851 71852 106ce31 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 71837->71852 71853 101da80 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71837->71853 71854 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71837->71854 71855 ffcfd0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71837->71855 71856 ff3510 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71837->71856 72320 ffbc40 4 API calls 3 library calls 71837->72320 72321 102dee0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 71837->72321 72322 102e0f0 RtlAllocateHeap RtlFreeHeap 71837->72322 71838->71837 71839->71837 71840->71832 71843->71837 71844->71837 71845->71837 71846->71837 71847->71837 71848->71837 71851->71837 71852->71837 71853->71837 71854->71837 71855->71837 71856->71837 71858 ff3c80 4 API calls 71857->71858 71859 fb5ae3 71858->71859 71860 ff3c50 4 API calls 71859->71860 71861 fb5b0e 71860->71861 71862 ff9ec0 4 API calls 71861->71862 71863 fb5b45 __fread_nolock 71862->71863 71864 ff9c10 4 API calls 71863->71864 71865 fb5b9d 71864->71865 71866 fb5bca 71865->71866 71867 fb5db5 71865->71867 71869 ff5e10 4 API calls 71866->71869 71868 f92700 4 API calls 71867->71868 71871 fb5dc5 71868->71871 71870 fb5bdb 71869->71870 71872 fb0780 15 API calls 71870->71872 72324 ff4ab0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71871->72324 71874 fb5bea 71872->71874 71877 fb5c00 71874->71877 71937 fb5c1d 71874->71937 71875 fb5dd8 71876 f92660 3 API calls 71875->71876 71880 fb5db3 71876->71880 71878 ff8000 5 API calls 71877->71878 71879 fb5c05 71878->71879 71882 ff8000 5 API calls 71879->71882 71881 fb5e25 71880->71881 71883 f92700 4 API calls 71880->71883 71888 ff9b50 4 API calls 71881->71888 71885 fb5c0d 71882->71885 71886 fb5e03 71883->71886 71884 fb5da4 71887 ff8000 5 API calls 71884->71887 71889 f92660 3 API calls 71885->71889 72325 ff4ab0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71886->72325 71887->71880 71891 fb5e52 71888->71891 71938 fb5c18 71889->71938 71893 ff9d70 4 API calls 71891->71893 71892 fb5e16 71894 f92660 3 API calls 71892->71894 71895 fb5e66 71893->71895 71894->71881 71898 f9bf00 7 API calls 71895->71898 71896 f92660 3 API calls 71899 fb84e0 71896->71899 71897 ff9b50 4 API calls 71897->71937 71900 fb5e6e 71898->71900 71902 ff9d70 4 API calls 71902->71937 71906 fb0780 15 API calls 71906->71937 71909 f92660 3 API calls 71909->71937 71918 ff8000 5 API calls 71918->71937 71937->71884 71937->71897 71937->71902 71937->71906 71937->71909 71937->71918 72323 ff4b10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 71937->72323 71938->71896 71996 ff7810 4 API calls 71995->71996 71997 fba7ba 71996->71997 71998 ff3c50 4 API calls 71997->71998 71999 fba7e2 71998->71999 72000 ff9ec0 4 API calls 71999->72000 72001 fba81d __fread_nolock 72000->72001 72001->72001 72002 fbb9f1 72001->72002 72004 ffd850 4 API calls 72001->72004 72003 f92040 4 API calls 72002->72003 72032 fba95e 72003->72032 72005 fba8e2 72004->72005 72006 fbad8b 72005->72006 72007 fba914 72005->72007 72010 1002a00 4 API calls 72006->72010 72009 ff5e10 4 API calls 72007->72009 72008 1072350 3 API calls 72011 fbb9fb 72008->72011 72012 fba925 72009->72012 72022 fbad89 72010->72022 72015 f92700 4 API calls 72011->72015 72013 fb0780 15 API calls 72012->72013 72014 fba930 72013->72014 72017 fba956 72014->72017 72041 fbaa15 72014->72041 72016 fbba12 72015->72016 72018 ff9c70 4 API calls 72016->72018 72019 ff8000 5 API calls 72017->72019 72023 fbba27 72018->72023 72019->72032 72020 fbb95d 72024 ff8000 5 API calls 72020->72024 72021 fbad7a 72026 ff8000 5 API calls 72021->72026 72025 1002a00 4 API calls 72022->72025 72022->72032 72057 fbae4b __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z std::locale::_Init 72022->72057 72027 f98920 4 API calls 72023->72027 72024->72032 72025->72057 72026->72022 72028 fbba3f Concurrency::cancel_current_task 72027->72028 72029 fbaa10 72029->71792 72030 ff3c50 4 API calls 72030->72057 72031 ffd850 4 API calls 72031->72041 72032->72008 72032->72029 72033 ff5b90 4 API calls 72033->72041 72034 fb0780 15 API calls 72034->72041 72035 ff8000 5 API calls 72035->72041 72036 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72036->72057 72037 ffd660 4 API calls 72037->72057 72038 ff5e10 4 API calls 72038->72041 72041->72002 72041->72021 72041->72031 72041->72032 72041->72033 72041->72034 72041->72035 72041->72038 72397 1002b20 4 API calls 2 library calls 72041->72397 72042 fa4540 14 API calls 72042->72057 72043 10527b0 3 API calls 72043->72057 72044 fa4970 10 API calls 72044->72057 72047 102bfb0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 72047->72057 72048 106ce31 std::_Facet_Register 4 API calls 72048->72057 72049 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72049->72057 72050 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72050->72057 72051 107a9d6 4 API calls 72051->72057 72052 101da80 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 72052->72057 72053 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72053->72057 72054 ffcfd0 4 API calls 72054->72057 72055 ff3510 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72055->72057 72056 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72056->72057 72057->72002 72057->72011 72057->72020 72057->72030 72057->72032 72057->72036 72057->72037 72057->72042 72057->72043 72057->72044 72057->72047 72057->72048 72057->72049 72057->72050 72057->72051 72057->72052 72057->72053 72057->72054 72057->72055 72057->72056 72058 102f0e0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 72057->72058 72398 ffbc40 4 API calls 3 library calls 72057->72398 72399 102dee0 RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 72057->72399 72400 102e0f0 RtlAllocateHeap RtlFreeHeap 72057->72400 72058->72057 72060 ff3c80 4 API calls 72059->72060 72061 fbbab3 72060->72061 72062 ff3c50 4 API calls 72061->72062 72063 fbbadd 72062->72063 72064 ff9ec0 4 API calls 72063->72064 72065 fbbb09 __fread_nolock 72064->72065 72066 ff9c10 4 API calls 72065->72066 72067 fbbb61 72066->72067 72068 fbbf2e 72067->72068 72069 fbbb94 72067->72069 72071 f92700 4 API calls 72068->72071 72070 ff5e10 4 API calls 72069->72070 72072 fbbba5 72070->72072 72073 fbbf3e 72071->72073 72074 fb0780 15 API calls 72072->72074 72402 ff4ab0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72073->72402 72076 fbbbb0 72074->72076 72080 fbbbc3 72076->72080 72147 fbbbfb 72076->72147 72077 fbbf54 72078 f92660 3 API calls 72077->72078 72079 fbbf2c 72078->72079 72082 f92700 4 API calls 72079->72082 72088 fbbfbc 72079->72088 72081 ff8000 5 API calls 72080->72081 72084 fbbbc8 72081->72084 72085 fbbf97 72082->72085 72083 ff8000 5 API calls 72083->72079 72086 ff8000 5 API calls 72084->72086 72403 ff4ab0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72085->72403 72090 fbbbd3 72086->72090 72089 fbddf4 72088->72089 72093 ffd850 4 API calls 72088->72093 72091 f92040 4 API calls 72089->72091 72094 f92660 3 API calls 72090->72094 72095 fbddf9 72091->72095 72092 fbbfad 72096 f92660 3 API calls 72092->72096 72097 fbc01d 72093->72097 72098 fbbbde 72094->72098 72099 1072350 3 API calls 72095->72099 72096->72088 72104 fbc052 std::locale::_Init 72097->72104 72404 ffbc40 4 API calls 3 library calls 72097->72404 72100 f92660 3 API calls 72098->72100 72103 fbddfe 72099->72103 72102 fbbbe6 72100->72102 72107 f92040 4 API calls 72103->72107 72108 f9bf00 7 API calls 72104->72108 72105 ff9b50 4 API calls 72105->72147 72117 fbc0dd 72108->72117 72111 ff9d70 4 API calls 72111->72147 72115 ff9bb0 4 API calls 72115->72147 72116 fb0780 15 API calls 72116->72147 72117->72095 72119 fbc19a 72117->72119 72120 ff9b50 4 API calls 72117->72120 72119->72103 72122 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 72122->72147 72136 ff8000 5 API calls 72136->72147 72138 fbbf1d 72138->72083 72145 ff5e10 4 API calls 72145->72147 72147->72105 72147->72111 72147->72115 72147->72116 72147->72122 72147->72136 72147->72138 72147->72145 72401 1002b20 4 API calls 2 library calls 72147->72401 72203 fc108f __fread_nolock 72202->72203 72203->72203 72204 fc2a32 72203->72204 72206 ffd850 4 API calls 72203->72206 72205 f92040 4 API calls 72204->72205 72238 fc1181 72205->72238 72207 fc10ff 72206->72207 72209 fc15ba 72207->72209 72210 fc1136 72207->72210 72208 1072350 3 API calls 72211 fc2a3c 72208->72211 72213 1002a00 4 API calls 72209->72213 72212 ff5e10 4 API calls 72210->72212 72214 f92040 4 API calls 72211->72214 72215 fc1147 72212->72215 72225 fc15b5 72213->72225 72216 fc2a41 72214->72216 72217 fb0780 15 API calls 72215->72217 72218 1072350 3 API calls 72216->72218 72219 fc1153 72217->72219 72221 fc2a46 72218->72221 72220 fc1179 72219->72220 72263 fc1238 72219->72263 72223 ff8000 5 API calls 72220->72223 72461 ff93d0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72221->72461 72223->72238 72224 fc15a9 72228 ff8000 5 API calls 72224->72228 72227 1002a00 4 API calls 72225->72227 72230 fc1674 72225->72230 72225->72238 72227->72230 72228->72225 72230->72211 72230->72230 72236 ffd850 4 API calls 72230->72236 72230->72238 72233 fc1233 72233->71792 72235 ffd850 4 API calls 72235->72263 72237 fc17a7 72236->72237 72241 f9b8e0 9 API calls 72237->72241 72238->72208 72238->72233 72240 ff5b90 4 API calls 72240->72263 72243 fc17bb 72241->72243 72246 ffa250 5 API calls 72243->72246 72287 fc1970 72243->72287 72245 fb0780 15 API calls 72245->72263 72247 fc1816 72246->72247 72253 ff9ec0 4 API calls 72247->72253 72249 fc290a 72249->72238 72250 ff8000 5 API calls 72249->72250 72250->72238 72251 ff8000 5 API calls 72251->72263 72256 fc1854 72253->72256 72258 ff9ec0 4 API calls 72256->72258 72256->72287 72257 ffd660 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72257->72287 72260 fc1894 72258->72260 72264 ff9ec0 4 API calls 72260->72264 72261 ff5e10 4 API calls 72261->72263 72262 f9b8e0 9 API calls 72262->72287 72263->72204 72263->72224 72263->72235 72263->72238 72263->72240 72263->72245 72263->72251 72263->72261 72453 1002b20 4 API calls 2 library calls 72263->72453 72265 fc18d4 72264->72265 72266 ff9ec0 4 API calls 72265->72266 72265->72287 72268 fc1914 72266->72268 72267 ffa250 5 API calls 72267->72287 72269 ff9ec0 4 API calls 72268->72269 72272 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72272->72287 72275 ff9ec0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72275->72287 72276 ff5b20 4 API calls 72276->72287 72278 fb0780 15 API calls 72278->72287 72279 ff8000 5 API calls 72279->72287 72282 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72282->72287 72283 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72283->72287 72287->72204 72287->72216 72287->72221 72287->72238 72287->72249 72287->72257 72287->72262 72287->72267 72287->72272 72287->72275 72287->72276 72287->72278 72287->72279 72287->72282 72287->72283 72413 fc0890 72287->72413 72456 ffa000 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 72287->72456 72457 f92540 5 API calls std::locale::_Init 72287->72457 72458 ff59f0 4 API calls 3 library calls 72287->72458 72459 1001b00 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72287->72459 72460 ff2640 ExitProcess RtlAllocateHeap RtlFreeHeap 72287->72460 72289 ff3c80 4 API calls 72288->72289 72290 fd03ac 72289->72290 72291 ff3c50 4 API calls 72290->72291 72292 fd03df 72291->72292 72293 ff9ec0 4 API calls 72292->72293 72310 fd0407 __fread_nolock 72293->72310 72294 fd044c RegOpenKeyExA 72294->72310 72295 fd11de 72295->71773 72296 ff5c30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72296->72310 72297 faffc0 5 API calls 72297->72310 72298 ff7810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72298->72310 72299 106ce31 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 72299->72310 72300 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72300->72310 72301 fd11f7 72302 f92700 4 API calls 72301->72302 72303 fd120e 72302->72303 72304 ff9c70 4 API calls 72303->72304 72305 fd1223 72304->72305 72306 f98920 4 API calls 72305->72306 72307 fd123b Concurrency::cancel_current_task 72306->72307 72308 1072350 3 API calls 72307->72308 72309 fd1254 72308->72309 72310->72294 72310->72295 72310->72296 72310->72297 72310->72298 72310->72299 72310->72300 72310->72301 72310->72307 72311 ffcfd0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72310->72311 72312 f92830 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72310->72312 72313 ff9ec0 4 API calls 72310->72313 72316 f92660 ExitProcess RtlAllocateHeap RtlFreeHeap 72310->72316 72641 ff3230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 72310->72641 72642 f927b0 ExitProcess RtlAllocateHeap RtlFreeHeap 72310->72642 72311->72310 72312->72310 72313->72310 72316->72310 72317->71792 72318->71792 72319->71832 72320->71837 72321->71837 72322->71837 72323->71937 72324->71875 72325->71892 72397->72041 72398->72057 72399->72057 72400->72057 72401->72147 72402->72077 72403->72092 72404->72104 72414 ff5e10 4 API calls 72413->72414 72415 fc0900 72414->72415 72416 f9b8e0 9 API calls 72415->72416 72417 fc090b 72416->72417 72462 106bc3e 4 API calls 5 library calls 72417->72462 72419 fc0983 72463 ff91d0 5 API calls 5 library calls 72419->72463 72421 fc099b 72464 ffadf0 5 API calls std::_Facet_Register 72421->72464 72453->72263 72456->72287 72457->72287 72458->72287 72460->72287 72462->72419 72463->72421 72641->72310 72642->72310 72643 fed180 72770 fd2250 72643->72770 72645 fed1e1 72645->72645 72646 fed238 72645->72646 72647 feebd6 72645->72647 72648 ffd850 4 API calls 72646->72648 72649 f92040 4 API calls 72647->72649 72650 fed261 CreateDirectoryA 72648->72650 72651 feebdb 72649->72651 72657 fede0f 72650->72657 72755 fed28c std::locale::_Init __Mtx_unlock 72650->72755 72652 f92040 4 API calls 72651->72652 72653 feebe0 72652->72653 72656 1072350 3 API calls 72653->72656 72654 feea99 72655 fedde1 72658 ff5e10 4 API calls 72655->72658 72659 feebe5 72656->72659 72660 feea5f 72657->72660 72665 fede78 72657->72665 72666 feec20 72657->72666 72670 feddf2 72658->72670 74258 106c05c 8 API calls std::locale::_Setgloballocale 72659->74258 72660->72654 72662 1072350 3 API calls 72660->72662 72684 feec74 72662->72684 72663 feebeb 72664 f92040 4 API calls 72663->72664 72667 feebf0 72664->72667 72669 ffd850 4 API calls 72665->72669 72668 f92040 4 API calls 72666->72668 72672 1072350 3 API calls 72667->72672 72673 feec25 72668->72673 72674 fedea1 CreateDirectoryA 72669->72674 72670->72657 72671 f9c050 13 API calls 72670->72671 72671->72657 72675 feebf5 72672->72675 72676 f92040 4 API calls 72673->72676 72686 feea2c 72674->72686 72749 fedec6 std::locale::_Init __Mtx_unlock 72674->72749 74259 106c05c 8 API calls std::locale::_Setgloballocale 72675->74259 72678 feec2a 72676->72678 72680 1072350 3 API calls 72678->72680 72679 feebfb 72683 f92040 4 API calls 72679->72683 72685 feec2f 72680->72685 72681 fee9fe 72682 ff5e10 4 API calls 72681->72682 72688 feea0f 72682->72688 72689 feec00 72683->72689 72690 feed1a 72684->72690 72691 feefe3 72684->72691 72738 feee15 72684->72738 74262 106c05c 8 API calls std::locale::_Setgloballocale 72685->74262 72686->72660 72687 1072350 3 API calls 72686->72687 72687->72660 73359 fa13c0 72688->73359 72696 1072350 3 API calls 72689->72696 72698 ffd850 4 API calls 72690->72698 72697 f92040 4 API calls 72691->72697 72693 feee66 72701 ffd850 4 API calls 72693->72701 72694 feeff2 72700 f92040 4 API calls 72694->72700 72703 feec05 72696->72703 72704 feefe8 72697->72704 72705 feed40 72698->72705 72699 feec35 72706 f92040 4 API calls 72699->72706 72707 feee9e 72700->72707 72708 feee8c 72701->72708 74260 106c05c 8 API calls std::locale::_Setgloballocale 72703->74260 72711 1072350 3 API calls 72704->72711 72712 feed7e 72705->72712 74266 10010f0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72705->74266 72713 feec3a 72706->72713 72714 1072350 3 API calls 72707->72714 72739 feeed0 72707->72739 72715 ff5e10 4 API calls 72708->72715 72709 ff5b90 4 API calls 72709->72755 72719 feefed 72711->72719 74267 f9c820 RtlAllocateHeap RtlFreeHeap ___std_exception_destroy ___std_exception_copy 72712->74267 72720 1072350 3 API calls 72713->72720 72721 feeffc 72714->72721 72715->72707 72718 feec0b 72723 1072350 3 API calls 72718->72723 72724 1072350 3 API calls 72719->72724 72726 feec3f 72720->72726 72722 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72722->72749 72730 feec10 72723->72730 72724->72694 74263 106c05c 8 API calls std::locale::_Setgloballocale 72726->74263 72727 feedaa 72727->72704 72731 feeddd 72727->72731 72729 106c3b3 GetSystemTimePreciseAsFileTime 72729->72755 72733 f92040 4 API calls 72730->72733 72731->72719 72731->72738 72732 feec45 72734 f92040 4 API calls 72732->72734 72735 feec15 72733->72735 72737 feec4a 72734->72737 74261 106c05c 8 API calls std::locale::_Setgloballocale 72735->74261 72741 1072350 3 API calls 72737->72741 72738->72693 72738->72694 72740 feec1b 72742 1072350 3 API calls 72740->72742 72743 feec4f 72741->72743 72742->72666 74264 106c05c 8 API calls std::locale::_Setgloballocale 72743->74264 72745 ff5b90 4 API calls 72745->72749 72746 feec55 72747 1072350 3 API calls 72746->72747 72748 feec5a 72747->72748 72750 f92040 4 API calls 72748->72750 72749->72673 72749->72678 72749->72681 72749->72685 72749->72699 72749->72713 72749->72722 72749->72726 72749->72732 72749->72737 72749->72743 72749->72745 72749->72746 72749->72748 72751 feec5f 72749->72751 72753 feec65 72749->72753 72756 ffbc40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72749->72756 72757 106c3b3 GetSystemTimePreciseAsFileTime 72749->72757 72761 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72749->72761 72763 f92830 4 API calls 72749->72763 72765 ffd660 4 API calls 72749->72765 72769 f9f050 14 API calls 72749->72769 74257 ff59f0 4 API calls 3 library calls 72749->74257 72750->72751 74265 106c05c 8 API calls std::locale::_Setgloballocale 72751->74265 72754 1072350 3 API calls 72753->72754 72754->72686 72755->72651 72755->72653 72755->72655 72755->72659 72755->72663 72755->72667 72755->72675 72755->72679 72755->72689 72755->72703 72755->72709 72755->72718 72755->72729 72755->72730 72755->72735 72755->72740 72758 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72755->72758 72759 f92830 4 API calls 72755->72759 72760 ffbc40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72755->72760 72762 ffd660 4 API calls 72755->72762 72766 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 72755->72766 74085 ff59f0 4 API calls 3 library calls 72755->74085 74086 f9f050 72755->74086 72756->72749 72757->72749 72758->72755 72759->72755 72760->72755 72761->72749 72762->72755 72763->72749 72765->72749 72766->72755 72769->72749 72771 fd2272 72770->72771 72772 ff9b50 4 API calls 72771->72772 72773 fd2620 72771->72773 72775 fd22cd 72772->72775 72776 ff9b50 4 API calls 72773->72776 72777 fd3b3e 72773->72777 72774 fd4f1f 72774->72645 72781 fd22de CreateDirectoryA 72775->72781 72778 fd2655 72776->72778 72779 ff9b50 4 API calls 72777->72779 72780 fd4cf6 72777->72780 72786 fd266a CreateDirectoryA 72778->72786 72782 fd3b8f 72779->72782 72780->72774 72783 ff9b50 4 API calls 72780->72783 72784 fd260e 72781->72784 72785 fd22ea 72781->72785 72790 fd3ba4 CreateDirectoryA 72782->72790 72787 fd4d29 72783->72787 72791 f92660 3 API calls 72784->72791 72797 ff9b50 4 API calls 72785->72797 72788 fd3b2c 72786->72788 72789 fd2677 72786->72789 72795 fd4d3e CreateDirectoryA 72787->72795 72792 f92660 3 API calls 72788->72792 72801 ff9b50 4 API calls 72789->72801 72793 fd4ce4 72790->72793 72794 fd3bb1 72790->72794 72791->72773 72792->72777 72796 f92660 3 API calls 72793->72796 72804 ff9b50 4 API calls 72794->72804 72798 fd4d4b 72795->72798 72799 fd4f14 72795->72799 72796->72780 72800 fd2328 72797->72800 72805 ff9b50 4 API calls 72798->72805 72802 f92660 3 API calls 72799->72802 72806 fd233b CreateDirectoryA 72800->72806 72803 fd26b6 72801->72803 72802->72774 72811 fd26ca CreateDirectoryA 72803->72811 72807 fd3bec 72804->72807 72808 fd4d87 72805->72808 72809 fd234c __fread_nolock 72806->72809 72810 fd2447 72806->72810 72814 fd3bfe CreateDirectoryA 72807->72814 72817 fd4d99 CreateDirectoryA 72808->72817 72818 fd235e SHGetFolderPathA 72809->72818 72821 ff9b50 4 API calls 72810->72821 72812 fd282a 72811->72812 72813 fd26d5 72811->72813 72824 ff9b50 4 API calls 72812->72824 72822 f92700 4 API calls 72813->72822 72815 fd3d2e 72814->72815 72816 fd3c0b 72814->72816 72830 ff9b50 4 API calls 72815->72830 72827 f92700 4 API calls 72816->72827 72820 fd4ef3 72817->72820 72852 fd4da6 72817->72852 72819 fd2398 72818->72819 72826 f92700 4 API calls 72819->72826 72823 f9c050 13 API calls 72820->72823 72828 fd4f06 72820->72828 72825 fd2479 72821->72825 72842 fd270b 72822->72842 72823->72828 72829 fd2865 72824->72829 72833 fd248d CreateDirectoryA 72825->72833 72831 fd23a4 72826->72831 72850 fd3c5c 72827->72850 72837 f92660 3 API calls 72828->72837 72838 fd2879 CreateDirectoryA 72829->72838 72832 fd3d6e 72830->72832 72836 ff9c70 4 API calls 72831->72836 72839 fd3d80 CreateDirectoryA 72832->72839 72834 fd2498 __fread_nolock 72833->72834 72835 fd25e0 72833->72835 72847 fd24ab SHGetFolderPathA 72834->72847 72840 fd25f5 72835->72840 72848 f9c050 13 API calls 72835->72848 72841 fd23ba 72836->72841 72837->72799 72843 fd2884 72838->72843 72844 fd2c93 72838->72844 72845 fd3d8d 72839->72845 72846 fd3e98 72839->72846 72851 f92660 3 API calls 72840->72851 72849 f92660 3 API calls 72841->72849 72855 ff9c70 4 API calls 72842->72855 72862 f92700 4 API calls 72843->72862 72861 ff9b50 4 API calls 72844->72861 72864 f92700 4 API calls 72845->72864 72863 ff9b50 4 API calls 72846->72863 72853 fd24eb 72847->72853 72848->72840 72854 fd23cc 72849->72854 72859 ff9c70 4 API calls 72850->72859 72856 fd2603 72851->72856 72857 f92830 4 API calls 72852->72857 72865 f92700 4 API calls 72853->72865 72871 f9bf90 10 API calls 72854->72871 72858 fd275a 72855->72858 72860 f92660 3 API calls 72856->72860 72874 fd4e1c 72857->72874 72866 f92660 3 API calls 72858->72866 72867 fd3c9f 72859->72867 72860->72784 72868 fd2cce 72861->72868 72879 fd28c5 72862->72879 72869 fd3ec2 72863->72869 72889 fd3dc6 72864->72889 72870 fd24f7 72865->72870 72872 fd276c 72866->72872 72873 f92660 3 API calls 72867->72873 72878 fd2ce2 CreateDirectoryA 72868->72878 72880 fd3ed4 CreateDirectoryA 72869->72880 72875 ff9c70 4 API calls 72870->72875 72876 fd23de 72871->72876 72892 f92700 4 API calls 72872->72892 72877 fd3cb1 72873->72877 72885 ff9c70 4 API calls 72874->72885 72881 fd250d 72875->72881 72882 fd2419 72876->72882 72891 ff5e10 4 API calls 72876->72891 72899 f9bf90 10 API calls 72877->72899 72883 fd2ced 72878->72883 72884 fd2e60 72878->72884 72894 ff9c70 4 API calls 72879->72894 72886 fd3fee 72880->72886 72887 fd3ee1 72880->72887 72890 f92660 3 API calls 72881->72890 72888 f9c050 13 API calls 72882->72888 72895 fd2420 72882->72895 72901 f92700 4 API calls 72883->72901 72904 ff9b50 4 API calls 72884->72904 72893 fd4e69 72885->72893 72910 ff9b50 4 API calls 72886->72910 72913 f92700 4 API calls 72887->72913 72888->72895 72905 ff9c70 4 API calls 72889->72905 72896 fd251f 72890->72896 72897 fd23f9 72891->72897 72898 fd2784 72892->72898 72902 f92660 3 API calls 72893->72902 72903 fd2908 72894->72903 72914 f92660 3 API calls 72895->72914 72918 f92700 4 API calls 72896->72918 72906 ff5e10 4 API calls 72897->72906 72907 f9bf00 7 API calls 72898->72907 72900 fd3cc3 72899->72900 72909 fd3d00 72900->72909 72917 ff5e10 4 API calls 72900->72917 72933 fd2d42 72901->72933 72911 fd4e7b 72902->72911 72912 f92660 3 API calls 72903->72912 72915 fd2ea5 72904->72915 72916 fd3e09 72905->72916 72908 fd240e 72906->72908 72937 fd2789 72907->72937 72920 f9f050 14 API calls 72908->72920 72919 f9c050 13 API calls 72909->72919 72929 fd3d07 72909->72929 72922 fd402c 72910->72922 72939 f9bf90 10 API calls 72911->72939 72923 fd291a 72912->72923 72947 fd3f1c 72913->72947 72914->72810 72927 fd2eb9 CreateDirectoryA 72915->72927 72924 f92660 3 API calls 72916->72924 72926 fd3cdf 72917->72926 72928 fd2537 72918->72928 72919->72929 72920->72882 72921 fd27ff 72925 f9c050 13 API calls 72921->72925 72931 fd2803 72921->72931 72938 fd403e CreateDirectoryA 72922->72938 72946 f92700 4 API calls 72923->72946 72930 fd3e1b 72924->72930 72925->72931 72932 ff5e10 4 API calls 72926->72932 72934 fd301b 72927->72934 72935 fd2ec4 72927->72935 72936 f9bf00 7 API calls 72928->72936 72941 f92660 3 API calls 72929->72941 72948 f9bf90 10 API calls 72930->72948 72949 f92660 3 API calls 72931->72949 72940 fd3cf4 72932->72940 72951 ff9c70 4 API calls 72933->72951 72960 ff9b50 4 API calls 72934->72960 72959 f92700 4 API calls 72935->72959 72937->72921 72942 ff9b50 4 API calls 72937->72942 72943 fd4718 72938->72943 72944 fd404b 72938->72944 72945 fd4e8d 72939->72945 72950 f9f050 14 API calls 72940->72950 72941->72815 72978 fd27d1 72942->72978 72970 ff9b50 4 API calls 72943->72970 72971 f92700 4 API calls 72944->72971 72953 fd4ec7 72945->72953 72961 ff5e10 4 API calls 72945->72961 72954 fd2932 72946->72954 72963 ff9c70 4 API calls 72947->72963 72956 fd3e2d 72948->72956 72949->72812 72950->72909 72957 fd2d85 72951->72957 72958 f9c050 13 API calls 72953->72958 72967 fd4ece 72953->72967 72962 f9bf00 7 API calls 72954->72962 72965 fd3e6a 72956->72965 72974 ff5e10 4 API calls 72956->72974 72966 f92660 3 API calls 72957->72966 72958->72967 72993 fd2f04 72959->72993 72969 fd305f 72960->72969 72972 fd4ea7 72961->72972 72991 fd2937 72962->72991 72973 fd3f5f 72963->72973 72975 fd2d97 72966->72975 72985 f92660 3 API calls 72967->72985 72980 ff5e10 4 API calls 72972->72980 72982 f92660 3 API calls 72973->72982 73010 f92660 3 API calls 72978->73010 72989 fd4ebc 72980->72989 72985->72820 73010->72921 74278 106f090 73359->74278 73362 106f090 __fread_nolock 73363 fa142a SHGetFolderPathA 73362->73363 73364 fa1471 73363->73364 73365 f92830 4 API calls 73364->73365 74085->72755 74087 f9f0d6 74086->74087 74088 f9f654 74087->74088 74089 ffd850 4 API calls 74087->74089 74090 f92040 4 API calls 74088->74090 74137 f9f129 __Mtx_unlock 74089->74137 74091 f9f659 74090->74091 75132 106c05c 8 API calls std::locale::_Setgloballocale 74091->75132 74093 1072350 3 API calls 74097 f9f664 __fread_nolock 74093->74097 74094 ffd850 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74094->74137 74095 ff5b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74095->74137 74096 f9f638 74096->72755 74099 f92830 4 API calls 74097->74099 74098 ff5c90 ExitProcess RtlAllocateHeap RtlFreeHeap 74098->74137 74100 f9f739 74099->74100 74101 ff9c70 4 API calls 74100->74101 74102 f9f74f 74101->74102 74103 f9f780 74102->74103 74105 fa04a5 74102->74105 74104 106c3b3 GetSystemTimePreciseAsFileTime 74103->74104 74106 f9f7b1 74104->74106 74107 1072350 3 API calls 74105->74107 74108 fa04aa 74106->74108 74107->74108 74116 106c3b3 GetSystemTimePreciseAsFileTime 74116->74137 74121 f9f4d5 74121->74093 74121->74096 74133 ff5e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 74133->74137 74137->74088 74137->74091 74137->74094 74137->74095 74137->74098 74137->74116 74137->74121 74137->74133 74143 f9f050 13 API calls 74137->74143 74143->74137 74257->72749 74266->72712 74267->72727 74279 fa13fd SHGetFolderPathA 74278->74279 74279->73362 75141 ff8e60 75142 ff8e87 75141->75142 75143 ff8e77 75141->75143 75143->75142 75144 1072350 3 API calls 75143->75144 75145 ff8e9c 75144->75145 75146 ff8f38 75145->75146 75153 106c162 75145->75153 75150 ff8ee2 75164 ffaf50 5 API calls 6 library calls 75150->75164 75152 ff8f02 75154 106c0be 75153->75154 75155 ff8ed1 75154->75155 75158 1072ef5 3 API calls 75154->75158 75159 106c117 75154->75159 75155->75146 75163 ff7de0 ExitProcess RtlAllocateHeap RtlFreeHeap 75155->75163 75157 106c13b 75157->75155 75160 1076cd6 6 API calls 75157->75160 75158->75159 75161 106c11e 75159->75161 75165 1072ef5 75159->75165 75160->75161 75161->75155 75162 1076788 7 API calls 75161->75162 75162->75155 75163->75150 75164->75152 75166 1072e3e __fread_nolock 75165->75166 75167 1072e51 75166->75167 75168 1072e71 75166->75168 75172 1072340 ExitProcess RtlAllocateHeap RtlFreeHeap __fread_nolock 75167->75172 75170 1084228 2 API calls 75168->75170 75171 1072e61 75168->75171 75170->75171 75171->75157 75172->75171

                                                                                                                                                                                                                                  Executed Functions

                                                                                                                                                                                                                                  Function 00FD2010 Relevance: 291.5, APIs: 22, Strings: 143, Instructions: 2735COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD22E0
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD233C
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD2CE3
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD2EBA
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD3074
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD3257
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD353E
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FD236D
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: GetFileAttributesA.KERNEL32(?,?,787C6B7B), ref: 00F9BFBE
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: __Mtx_unlock.LIBCPMT ref: 00F9BFEE
                                                                                                                                                                                                                                    • Part of subcall function 00FF5E10: Concurrency::cancel_current_task.LIBCPMT ref: 00FF5EF7
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD248E
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FD24BD
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD266D
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD26CB
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD287A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateDirectory$FolderPath$AttributesConcurrency::cancel_current_taskFileMtx_unlock
                                                                                                                                                                                                                                  • String ID: AGC$LK$\FR$$v3)$(='>$.)%9$8b96$?#?/$AUE$AUE$CWK[$DGGL$DYCZ$DYCZ$DYCZ$DYCZ$DYCZ$EC^\$EC^\$EMA$EMA$FICZ$FU_F$HSS$HSS$HSS$J@}$J@}$J@}$JBB$JNL]$JNL]$JNL]$J^nB$K% /$LEC$Ln#+$MEJ$MEJ$MEJ$MEJ$MEJ$NO_O$NvDB$NvDB$OU\R$QORP$R\\T$SYM$T[OD$T\LK$XICI$Y\AK$[_CS$[_CS$[_CS$\XB^$]UQ[$^BNF$_@H$_@H$_CFK$_DH\$e.$ $fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$f|t$gm}~$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$kHKU$kKM_$kgjk$kqes$r{lx$tJY^${IJI${IJI${IJI${IJI${IJI${KFD${KFD${KFD${KFD${KFD${LH^${LH^${LH^${MPu${[H\${[XF${[XF${[XF${\FR${_JR${aj{${aj{${dFI${dFI${dFI${d\D${e@D${eLY${jH^${jH^${mEO${n@F${n@F${nLK${oHG${o[E${x@N${{@M${{@M${{BS${{]O${|FR${|eK${~bh${~yd
                                                                                                                                                                                                                                  • API String ID: 4270311917-1976377417
                                                                                                                                                                                                                                  • Opcode ID: 4d8d6715274b14ce727015cd58b0b3b0e1612ecf80f6e27552c25ff1cbf8d1a8
                                                                                                                                                                                                                                  • Instruction ID: 8ad10db52cd9ad15230853203b43611b9a32a7b11731a80a2657ff9b8f70a1dc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4d8d6715274b14ce727015cd58b0b3b0e1612ecf80f6e27552c25ff1cbf8d1a8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B243BF70C0425C9AEF25EBA0CC55BEDB775AF21304F4441D8E54977292EB782B88DFA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FD2250 Relevance: 289.5, APIs: 22, Strings: 142, Instructions: 2535COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD22E0
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD233C
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD2CE3
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FD236D
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: GetFileAttributesA.KERNEL32(?,?,787C6B7B), ref: 00F9BFBE
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: __Mtx_unlock.LIBCPMT ref: 00F9BFEE
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD248E
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FD24BD
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD266D
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD26CB
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD287A
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateDirectory$FolderPath$AttributesFileMtx_unlock
                                                                                                                                                                                                                                  • String ID: AGC$LK$\FR$$v3)$(='>$.)%9$8b96$?#?/$AUE$AUE$CWK[$DGGL$DYCZ$DYCZ$DYCZ$DYCZ$DYCZ$EC^\$EC^\$EMA$EMA$FICZ$FU_F$HSS$HSS$HSS$J@}$J@}$J@}$JBB$JNL]$JNL]$JNL]$J^nB$K% /$LEC$Ln#+$MEJ$MEJ$MEJ$MEJ$MEJ$NO_O$NvDB$NvDB$OU\R$QORP$R\\T$SYM$T[OD$XICI$Y\AK$[_CS$[_CS$[_CS$\XB^$]UQ[$^BNF$_@H$_@H$_CFK$_DH\$e.$ $fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$fxyn$f|t$gm}~$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$jxl$kHKU$kKM_$kgjk$kqes$r{lx$tJY^${IJI${IJI${IJI${IJI${IJI${KFD${KFD${KFD${KFD${KFD${LH^${LH^${LH^${MPu${[H\${[XF${[XF${[XF${\FR${_JR${aj{${aj{${dFI${dFI${dFI${d\D${e@D${eLY${jH^${jH^${mEO${n@F${n@F${nLK${oHG${o[E${x@N${{@M${{@M${{BS${{]O${|FR${|eK${~bh${~yd
                                                                                                                                                                                                                                  • API String ID: 2791087084-1101755663
                                                                                                                                                                                                                                  • Opcode ID: 6c358b801b5ddbb43e051209f4af605f67e25680683e6240345c1d0be303ee06
                                                                                                                                                                                                                                  • Instruction ID: 42cf9bd946d1feb8564b0fde037ca53a1b04bb2bb9705df5c43157cb7bda5b34
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6c358b801b5ddbb43e051209f4af605f67e25680683e6240345c1d0be303ee06
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6933AE70C0525C9AEF25EBA0CC55BEDB774AF21304F4441D8E54977292EB782B88DFA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FE52B0 Relevance: 263.4, APIs: 36, Strings: 110, Instructions: 7898COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesCreateDirectoryFile
                                                                                                                                                                                                                                  • String ID: \Q^$\Q^$\Q^$\Q^$\Q^$\Q^$\Q^$@EH]$@EH]$@EH]$@^uS$@^uS$@^uS$@^uS$BPYC$BPYC$BPYC$BPYC$BPYu$BPYu$BPYu$BPYu$C@M$CGDK$CGDK$DI[N$DI[N$DJDB$DJDB$E@BO$E@BO$EM@K$EM@K$FCCZ$FCCZ$G@X#$IAJA$IAJA$IIDO$IIDO$IIDO$IIDO$IIDO$IIDO$KIZ^$KIZ^$LQCV$LQCV$MUC$MUC$O\]Z$QIE_$QIE_$RIL\$RIL\$RZE$RZE$RZE$RZE$SADO$SADO$SGBO$TMJ_$TMJ_$TM[\$WI]B$WI]B$WI]B$WI]B$WI]B$X!'$X&'$YMYG$YMYG$YMYG$YMYG$\_H\$\_H\$\_H\$\_H\$\_H\$_C_W$_TY$aiey$aiey$dBAW$dBAW$sz|o$sz|o$sz|o$tBXC$tBXC$tCCq$tCCq$tJB[$tJB[$type must be boolean, but is ${`@Y${`@Y${j[E${j[E${j[E${j[E${j[E${kFE${kFE${kFE${kj${lF]${lF]
                                                                                                                                                                                                                                  • API String ID: 3883471643-3051686586
                                                                                                                                                                                                                                  • Opcode ID: b805028310e469d0ab8a4e0676cfe30e7d31dbb82373ca4c7853ddb5f0674faf
                                                                                                                                                                                                                                  • Instruction ID: 3c1ae17e061ccf8e5e81b4e2be551c289587c5f3a2f5e10a497126edc32ec85d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b805028310e469d0ab8a4e0676cfe30e7d31dbb82373ca4c7853ddb5f0674faf
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3AF3FE70D042988FEF29DB28CC487EEBBB5AF15304F1441D8E049A7292DB799B85EF51
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FA0580 Relevance: 254.1, APIs: 13, Strings: 130, Instructions: 3825COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(?,?), ref: 00FA0784
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA07B2
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA09DD
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA09EC
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA0D86
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA0D96
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA0F76
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA0F85
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA10C6
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: GetFileAttributesA.KERNEL32(?,?,787C6B7B), ref: 00F9BFBE
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: __Mtx_unlock.LIBCPMT ref: 00F9BFEE
                                                                                                                                                                                                                                    • Part of subcall function 00FF5E10: Concurrency::cancel_current_task.LIBCPMT ref: 00FF5EF7
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA10D5
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA126B
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FA1415
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00FA143C
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesFileFolderPath$Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID: @Y_$AsPA$BBNA$B|eq$CANC$CI_$CI_$CM_I$DEC$DEC$DEC$DEC$D^T$D^T$EC@G$EEYK$FEN$FFT$GIY]$HCD@$HCD@$HCD@$HCD@$HCD@$HCD@$HCD@$HSS$HX_A$HX_[$HX_[$J@}$J@}$J@}$J@}$J@}$J@}$JBNK$JND$JOBG$L_X\$MUCF$NOBG$NTHJ$NTHJ$NTHJ$NTHJ$NTHJ$NTHJ$N^b$N^B$N^H[$OY^$S%5$S%51$SW^_$VTU_$V_\$WYIM$XJX]$YHL$YHL$[T\N$[T\N$[_CS$[_CS$[_CS$[_CS$[_CS$[_CS$^]WN$_EiA$_MAM$`GEN$aDFX$aZHD$aZLC$cGNO$cIZB$eA]I$ejxi$fFFD$gk\R$hCD@$hC_K$iIDO$jAGI$jMNK$kA]O$kMMM$kOXV$nFOC$nPJE$ngjE$sM[X$uMMN$wZ@G${J@^${_HF${_HF${aGN${aGN${aGN${aGN${aGN${aGN${bHR${bHR${dFI${dFI${dFI${dFI${dFI${dFI${eFD${e\F${i[G${i[G${i]E${j@D${j@^${kFC${mEO${mEO${mEO${mQE${m]B${o\K${o\K$}KHY$~ijE
                                                                                                                                                                                                                                  • API String ID: 1290385620-2583150534
                                                                                                                                                                                                                                  • Opcode ID: be4e9e39446806fee1fe1c5e5a95157c574710d10765c08152910a2ebabb3f6b
                                                                                                                                                                                                                                  • Instruction ID: 4e3093c19c48ce8ab023460795e6578ae5cb7c031dc55a31c126bc81074f5c5c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: be4e9e39446806fee1fe1c5e5a95157c574710d10765c08152910a2ebabb3f6b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 53730370D00258DAEF14EB64CC55BEDBB75AF12304F4441D8E44977292EB792B88EFA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FA13C0 Relevance: 228.2, APIs: 2, Strings: 127, Instructions: 2459COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FA1415
                                                                                                                                                                                                                                  • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00FA143C
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FolderPath
                                                                                                                                                                                                                                  • String ID: @Y_$AsPA$BBNA$B|eq$CANC$CI_$CI_$CM_I$DEC$DEC$DEC$DEC$D^T$D^T$EC@G$EEYK$FEN$FFT$HCD@$HCD@$HCD@$HCD@$HCD@$HCD@$HCD@$HSS$HX_A$HX_[$HX_[$J@}$J@}$J@}$J@}$J@}$J@}$JBNK$JND$JOBG$L_X\$MUCF$NOBG$NTHJ$NTHJ$NTHJ$NTHJ$NTHJ$NTHJ$N^b$N^B$N^H[$OY^$S%5$S%51$SW^_$VTU_$V_\$WYIM$XJX]$YHL$YHL$[T\N$[T\N$[_CS$[_CS$[_CS$[_CS$[_CS$[_CS$^]WN$_EiA$_MAM$`GEN$aDFX$aZHD$aZLC$cGNO$cIZB$eA]I$ejxi$fFFD$gk\R$hCD@$hC_K$iIDO$jAGI$jMNK$kA]O$kMMM$kOXV$nFOC$nPJE$ngjE$sM[X$uMMN$wZ@G${J@^${aGN${aGN${aGN${aGN${aGN${aGN${bHR${bHR${dFI${dFI${dFI${dFI${dFI${dFI${eFD${e\F${i[G${i[G${i]E${j@D${j@^${kFC${mEO${mEO${mEO${mQE${m]B${o\K${o\K$}KHY$~ijE
                                                                                                                                                                                                                                  • API String ID: 1514166925-4148695695
                                                                                                                                                                                                                                  • Opcode ID: edc0e42b9de8b2bd910f4341738626633174971201a60fdf69264a3632fd8aec
                                                                                                                                                                                                                                  • Instruction ID: adaa399e9d912a8bb0a977d6d7c89cb58f74178def05693f33f0f56dc2565c1e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: edc0e42b9de8b2bd910f4341738626633174971201a60fdf69264a3632fd8aec
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6133C170D0425CDAEF60EB64CC55BEDBB74AF11304F4445D8E84967292EB781B88EFA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FC48E0 Relevance: 98.0, APIs: 2, Strings: 53, Instructions: 1745COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FC5986
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FC599B
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: GetFileAttributesA.KERNEL32(?,?,787C6B7B), ref: 00F9BFBE
                                                                                                                                                                                                                                    • Part of subcall function 00F9BF90: __Mtx_unlock.LIBCPMT ref: 00F9BFEE
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesFile
                                                                                                                                                                                                                                  • String ID: AG[G$AG[G$AG[G$B@H$B@H$B@H$BB^$DM[^$DM[^$EC^\$EM@K$EXXC$FDd`$FDd`$FDd`$KGNC$KGNC$KGNC$KGNC$KGNC$MEAK$OGZ^$RZE$RZE$RZE$WIZY$WIZY$WZFL$WZFL$\C_J$\C_J$cannot use operator[] with a string argument with $psT@$wI]B$wZFL$xYOC$xYOC$xYOC${CLS${CLS${CLS${CLS${CLS${CLS${DFM${KLX${KLX${KLX${KLX${KLX${KLX${X[E${y\K
                                                                                                                                                                                                                                  • API String ID: 1886074773-2890223016
                                                                                                                                                                                                                                  • Opcode ID: 3cea3205ba0abe09cb4568e7f5df2148e104713200043101d550915a50a3d061
                                                                                                                                                                                                                                  • Instruction ID: 6373b7b279efb3be8f2bbf66a1d8522762bc30aacca87192395c29ecddf571ff
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3cea3205ba0abe09cb4568e7f5df2148e104713200043101d550915a50a3d061
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 10F2EE70C042598BEF29EB64CD55BEDBBB4AF15304F0441DCE44967292EB782B88DF92
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FB5A90 Relevance: 60.3, Strings: 46, Instructions: 2804COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                                                  • String ID: BFJX$BFJX$BFJX$BFJX$BPYu$BPYu$DI[N$DI[N$DI[N$EM@K$EM@K$FCCZ$HZ@M$H[vI$H[vI$H[vI$H[vI$H[vI$H[vI$IAJA$IAJA$IIDO$IIDO$KIZ^$KoZW$KoZW$KoZW$KoZW$LQCV$LQCV$MUC$RIL\$R\YK$R\YK$R\YK$R\YK$YU]Z$YU]Z$YU]Z$YU]Z$YU]Z$YU]Z$tBXC$tCCq$tCCq$tJB[
                                                                                                                                                                                                                                  • API String ID: 1620887387-3550693116
                                                                                                                                                                                                                                  • Opcode ID: 8cd1f24f3cfe8c975d796f8d80972c02e56abd6b3857f0f22bcf4a2ba055431f
                                                                                                                                                                                                                                  • Instruction ID: 09f1a657d9a31b871968fa38c0be6f65cb5734ce8094508f2521233082815c29
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8cd1f24f3cfe8c975d796f8d80972c02e56abd6b3857f0f22bcf4a2ba055431f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4443FF70D042598BEB25DF24CC44BEEBBB4AF55304F1441D8E489A7292EB78AF84DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FB8570 Relevance: 60.0, APIs: 1, Strings: 32, Instructions: 2231COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                                                  • String ID: @^uS$BFJX$BFJX$BFJX$BI^$BI^$BPYC$CGDK$DGFA$DGFA$D^Fr$H[vI$H[vI$H[vI$IIDO$KoZW$KoZW$O\]Z$QIE_$QIE_$R\YK$R\YK$R\YK$TMJ_$WI]B$YMYG$YU]Z$YU]Z$YU]Z$cannot use operator[] with a string argument with $dBAW$iM]]
                                                                                                                                                                                                                                  • API String ID: 1620887387-85083418
                                                                                                                                                                                                                                  • Opcode ID: 137e985cc4551b8b5aed52faffb7724e2da92252c8914db18ee9cfb70028f460
                                                                                                                                                                                                                                  • Instruction ID: ebd6a9e2cd7b7bd1e04384c8b02393d60555e4cc2b4bdb25d9d2381e2a1810e7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 137e985cc4551b8b5aed52faffb7724e2da92252c8914db18ee9cfb70028f460
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0C23ED70D042588BEF25DF64CC94BEEBBB4AF14304F1441D8E44967292EB78AB89DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FDDB80 Relevance: 53.8, Strings: 42, Instructions: 1269COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 14000 fddb80-fddbbb 14001 fddbc2-fddbe7 14000->14001 14002 fddbed-fddc2c 14001->14002 14003 fdeea6-fdeeb3 call fd0360 14001->14003 14004 fddc30-fddc3e 14002->14004 14007 fdeeb8-fdeece 14003->14007 14004->14004 14006 fddc40-fddc6c 14004->14006 14008 fddc70-fddc75 14006->14008 14009 fdeed0-fdeedb 14007->14009 14008->14008 14010 fddc77-fddcac call f92830 14008->14010 14009->14009 14011 fdeedd-fdef0c call ff9ec0 call ff3910 14009->14011 14016 fddcb0-fddcbe 14010->14016 14021 fdef10-fdef1b 14011->14021 14016->14016 14018 fddcc0-fddcef 14016->14018 14020 fddcf0-fddcf5 14018->14020 14020->14020 14023 fddcf7-fddd6a call f92830 call ff5e10 * 2 call fb0b90 14020->14023 14021->14021 14022 fdef1d-fdef93 call ff9ec0 call ff38b0 * 2 14021->14022 14038 fddd70-fddd7b 14023->14038 14038->14038 14039 fddd7d-fdde36 call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14038->14039 14050 fdde40-fdde4e 14039->14050 14050->14050 14051 fdde50-fdde7c 14050->14051 14052 fdde80-fdde85 14051->14052 14052->14052 14053 fdde87-fddeb6 call f92830 14052->14053 14056 fddec0-fddece 14053->14056 14056->14056 14057 fdded0-fddefc 14056->14057 14058 fddf00-fddf05 14057->14058 14058->14058 14059 fddf07-fddf7a call f92830 call ff5e10 * 2 call fb0b90 14058->14059 14068 fddf80-fddf8b 14059->14068 14068->14068 14069 fddf8d-fde038 call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14068->14069 14080 fde040-fde04e 14069->14080 14080->14080 14081 fde050-fde079 14080->14081 14082 fde080-fde085 14081->14082 14082->14082 14083 fde087-fde0ed call f92830 call ff5e10 call fb33d0 14082->14083 14090 fde0f0-fde0fe 14083->14090 14090->14090 14091 fde100-fde1ac call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14090->14091 14102 fde1b0-fde1bb 14091->14102 14102->14102 14103 fde1bd-fde1dc 14102->14103 14104 fde1e3-fde1e8 14103->14104 14104->14104 14105 fde1ea-fde247 call f92830 call ff5e10 call fb4730 14104->14105 14112 fde250-fde25e 14105->14112 14112->14112 14113 fde260-fde31f call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14112->14113 14124 fde320-fde32e 14113->14124 14124->14124 14125 fde330-fde35c 14124->14125 14126 fde360-fde365 14125->14126 14126->14126 14127 fde367-fde39b call f92830 14126->14127 14130 fde3a0-fde3ae 14127->14130 14130->14130 14131 fde3b0-fde3dc 14130->14131 14132 fde3e0-fde3e5 14131->14132 14132->14132 14133 fde3e7-fde43d call f92830 call ff5e10 call fb5a90 14132->14133 14140 fde441-fde44c 14133->14140 14140->14140 14141 fde44e-fde507 call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14140->14141 14152 fde510-fde51e 14141->14152 14152->14152 14153 fde520-fde54c 14152->14153 14154 fde550-fde555 14153->14154 14154->14154 14155 fde557-fde57c call f92830 14154->14155 14158 fde580-fde58b 14155->14158 14158->14158 14159 fde58d-fde5ac 14158->14159 14160 fde5b3-fde5b8 14159->14160 14160->14160 14161 fde5ba-fde61d call f92830 call ff5e10 call fb8570 14160->14161 14168 fde620-fde62e 14161->14168 14168->14168 14169 fde630-fde6ef call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14168->14169 14180 fde6f0-fde6fe 14169->14180 14180->14180 14181 fde700-fde72c 14180->14181 14182 fde730-fde735 14181->14182 14182->14182 14183 fde737-fde75c call f92830 14182->14183 14186 fde760-fde76b 14183->14186 14186->14186 14187 fde76d-fde78c 14186->14187 14188 fde793-fde798 14187->14188 14188->14188 14189 fde79a-fde7fd call f92830 call ff5e10 call fb8570 14188->14189 14196 fde800-fde80e 14189->14196 14196->14196 14197 fde810-fde8bc call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14196->14197 14208 fde8c0-fde8cb 14197->14208 14208->14208 14209 fde8cd-fde8ec 14208->14209 14210 fde8f3-fde8f8 14209->14210 14210->14210 14211 fde8fa-fde95b call f92830 call ff5e10 call fba760 14210->14211 14218 fde960-fde96e 14211->14218 14218->14218 14219 fde970-fdea2f call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14218->14219 14230 fdea30-fdea3e 14219->14230 14230->14230 14231 fdea40-fdea6c 14230->14231 14232 fdea70-fdea75 14231->14232 14232->14232 14233 fdea77-fdea9c call f92830 14232->14233 14236 fdeaa2-fdeaad 14233->14236 14236->14236 14237 fdeaaf-fdeace 14236->14237 14238 fdead5-fdeada 14237->14238 14238->14238 14239 fdeadc-fdeb32 call f92830 call ff5e10 call fbba60 14238->14239 14246 fdeb36-fdeb41 14239->14246 14246->14246 14247 fdeb43-fdebce call ff9ec0 call ff3910 call ff3510 call ff38b0 * 2 14246->14247 14258 fded7c-fded83 14247->14258 14259 fdebd4-fdebff 14247->14259 14258->14001 14260 fdec02-fdec10 14259->14260 14260->14260 14261 fdec12-fdec3e 14260->14261 14262 fdec40-fdec45 14261->14262 14262->14262 14263 fdec47-fdec80 call f92830 call ff5e10 call fc1010 14262->14263 14269 fdec85-fdec8e 14263->14269 14270 fdec90-fdecb1 14269->14270 14271 fdecb7-fded33 call ff5e10 * 4 14270->14271 14272 fded71-fded77 call ff2640 14270->14272 14282 fded35-fded51 call 10096f0 call fdf0b0 14271->14282 14283 fded56-fded6c call 1001220 call fdf0b0 14271->14283 14272->14258 14282->14270 14283->14270
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: BI^$BI^$BI^$BI^$DCF$DGFA$DGFA$DI[N$D^T$D^T$D^T$F]]E$KGNC$KGNC$MEAB$NDT$NDT$NDT$NDT$NDT$NDT$OAZ^$T[VO$dGFA$dGFA$h]]F$kGJK$kGJK$kGJK$kGJK$kGJK$kGJK$kGNC$kGNC$oAZ^$oAZ^$oMYO$oMYO$oMYO$pMK$pMK$pMK
                                                                                                                                                                                                                                  • API String ID: 0-428746264
                                                                                                                                                                                                                                  • Opcode ID: d20c2a4b4291a3f6f6579cfee9e2d155d73b864a8ce9e730a47f186d21ec304b
                                                                                                                                                                                                                                  • Instruction ID: 453028693adb44472795b0fd8eecbcee021440a14aa3bac6d16d56e8bdc81686
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d20c2a4b4291a3f6f6579cfee9e2d155d73b864a8ce9e730a47f186d21ec304b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B3C2EC70D042898FDB25DF64C8447EEBBB1AF5A304F1881CDD4896B342EB359A89DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FED180 Relevance: 45.8, APIs: 18, Strings: 7, Instructions: 2073COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00FD2250: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD22E0
                                                                                                                                                                                                                                    • Part of subcall function 00FD2250: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00FD233C
                                                                                                                                                                                                                                    • Part of subcall function 00FD2250: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FD236D
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000,?,5F45787B,010C3AFC,00000000,5F45787B,5F45787C), ref: 00FED282
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FED496
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FED4A5
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FED6B6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FED6C5
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FED8C6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FED8D5
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEDBC6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEDBD5
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE0CE
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE0DD
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE2D6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE2E5
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE4E7
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE4F6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE7E6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FEE7F5
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000,?,46487F7B,010C3AFC,00000000,46487F7B,46487F7C), ref: 00FEDEBC
                                                                                                                                                                                                                                    • Part of subcall function 00FFD850: Concurrency::cancel_current_task.LIBCPMT ref: 00FFD92D
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$CreateDirectory$Concurrency::cancel_current_taskFolderPath
                                                                                                                                                                                                                                  • String ID: GIY]$SIIj$kGJK$nFMO$tQGI${n@F${xE_
                                                                                                                                                                                                                                  • API String ID: 791088107-847423877
                                                                                                                                                                                                                                  • Opcode ID: 1e9c7b1848d3ae858a368cd11e75c23c8e5980f5bddee16b57be9df49ccea95a
                                                                                                                                                                                                                                  • Instruction ID: 33348515515ced63333827ee177482d8e3b4bd51058afd35732c1ea1fc821375
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1e9c7b1848d3ae858a368cd11e75c23c8e5980f5bddee16b57be9df49ccea95a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 69034A31D00299CFEF28CB68CC84BEDBB75AF15304F14829CE085BB692D7759A85DB61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00F9F050 Relevance: 43.7, APIs: 19, Strings: 5, Instructions: 1719COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesFile
                                                                                                                                                                                                                                  • String ID: J@}$NTHJ$[_CS${aGN${dFI
                                                                                                                                                                                                                                  • API String ID: 1886074773-2598508030
                                                                                                                                                                                                                                  • Opcode ID: f1cef3af4cd426a680efcd4dc140764daf34d84966cd7c59937ae4e11ce71283
                                                                                                                                                                                                                                  • Instruction ID: 2cbfbf45ee12df98826ee00fb5e881c835b70fed0766ba002794e4770307d27c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f1cef3af4cd426a680efcd4dc140764daf34d84966cd7c59937ae4e11ce71283
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FFD25A70D002089BEF18DBB8CC947FDBB75AF16314F24826CE445E7292DB359A89DB61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FD0360 Relevance: 43.0, APIs: 1, Strings: 23, Instructions: 954registryCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 15944 fd0360-fd041d call ff3c80 call ff3c50 call fa0550 call ff9ec0 call ff38d0 15955 fd0423-fd045a call ff5e10 call f927a0 RegOpenKeyExA 15944->15955 15960 fd11b4-fd11d8 call f92660 15955->15960 15961 fd0460-fd0498 call 106f090 15955->15961 15960->15955 15966 fd11de-fd11f6 15960->15966 15968 fd049e 15961->15968 15969 fd11ab-fd11b3 15961->15969 15970 fd04a0-fd04bd 15968->15970 15969->15960 15973 fd116d-fd11a5 call 106f090 15970->15973 15974 fd04c3-fd0582 call 106f090 * 5 15970->15974 15973->15969 15973->15970 15988 fd0586-fd0591 15974->15988 15988->15988 15989 fd0593-fd05b9 15988->15989 15991 fd05bf-fd061c 15989->15991 15992 fd1164-fd116c 15989->15992 15993 fd0622-fd0627 15991->15993 15992->15973 15993->15993 15995 fd0629-fd069a call f92830 call 106f090 * 2 15993->15995 16002 fd06a0-fd06ab 15995->16002 16002->16002 16003 fd06ad-fd06d3 16002->16003 16005 fd06d5-fd0724 call f9da00 16003->16005 16006 fd0726-fd072d 16003->16006 16005->16006 16010 fd077d-fd079e 16005->16010 16008 fd072f-fd0735 16006->16008 16009 fd074b-fd0752 16006->16009 16013 fd0738-fd073d 16008->16013 16009->16010 16011 fd0754-fd075d 16009->16011 16016 fd07a0-fd07ab 16010->16016 16015 fd0760-fd0765 16011->16015 16013->16013 16014 fd073f-fd0741 16013->16014 16014->16009 16017 fd0743-fd0749 16014->16017 16015->16015 16018 fd0767-fd0769 16015->16018 16016->16016 16019 fd07ad-fd07d0 16016->16019 16021 fd0771-fd0778 call ff5c30 16017->16021 16018->16010 16022 fd076b 16018->16022 16025 fd07d6-fd082b call f9a710 16019->16025 16026 fd08e3-fd08ea 16019->16026 16021->16010 16022->16021 16025->16026 16046 fd0831-fd0886 call f9a710 16025->16046 16027 fd092d-fd0934 16026->16027 16028 fd08ec-fd08f2 16026->16028 16031 fd0978-fd097f 16027->16031 16032 fd0936-fd093f 16027->16032 16033 fd08f5-fd08fa 16028->16033 16034 fd09cb-fd09d2 16031->16034 16035 fd0981-fd098a 16031->16035 16037 fd0940-fd0945 16032->16037 16033->16033 16036 fd08fc-fd08fe 16033->16036 16041 fd0a2a-fd0a8c call ff5940 * 2 call ff5960 call ffa8f0 call ff5980 16034->16041 16042 fd09d4-fd09dd 16034->16042 16038 fd0990-fd0995 16035->16038 16036->16027 16039 fd0900-fd0928 call f9b880 call ff5c30 16036->16039 16037->16037 16043 fd0947-fd0949 16037->16043 16038->16038 16044 fd0997-fd0999 16038->16044 16068 fd0a1c-fd0a27 call faffc0 16039->16068 16086 fd0a91-fd0b1f call ff7810 call 106ce31 call ff5e10 16041->16086 16048 fd09e0-fd09e5 16042->16048 16043->16031 16049 fd094b-fd0973 call f9b880 call ff5c30 16043->16049 16044->16034 16050 fd099b-fd09c9 call f9b880 call ff5c30 16044->16050 16046->16026 16075 fd0888-fd08dd call f9a710 16046->16075 16048->16048 16054 fd09e7-fd09e9 16048->16054 16049->16068 16050->16068 16054->16041 16060 fd09eb-fd0a16 call f9b880 call ff5c30 16054->16060 16060->16068 16068->16041 16075->16026 16075->16086 16093 fd0b23-fd0b2e 16086->16093 16093->16093 16094 fd0b30-fd0b3c 16093->16094 16095 fd0b6c-fd0b6e 16094->16095 16096 fd0b3e-fd0b6a call ff7810 16094->16096 16098 fd0b74 16095->16098 16099 fd11f7-fd124a call ff7ae0 call f92700 call ff9c70 call f98920 call 106ea9b 16095->16099 16102 fd0b7a-fd0b9e 16096->16102 16098->16102 16122 fd124f-fd1254 call 1072350 16099->16122 16104 fd0ba1-fd0ba6 16102->16104 16104->16104 16106 fd0ba8-fd0bdb call f92830 call ffcfd0 16104->16106 16115 fd0bdd-fd0bec 16106->16115 16116 fd0c0c-fd0cce call ff38b0 call 106ce31 call ff5e10 16106->16116 16119 fd0bee-fd0bfc 16115->16119 16120 fd0c02-fd0c09 call 106d0b2 16115->16120 16132 fd0cd0-fd0cdb 16116->16132 16119->16120 16119->16122 16120->16116 16132->16132 16133 fd0cdd-fd0d02 16132->16133 16134 fd0d05-fd0d0a 16133->16134 16134->16134 16135 fd0d0c-fd0d40 call f92830 call ffcfd0 16134->16135 16140 fd0d71-fd0e0e call ff38b0 call 106ce31 16135->16140 16141 fd0d42-fd0d51 16135->16141 16150 fd0e15-fd0e1a 16140->16150 16142 fd0d67-fd0d6e call 106d0b2 16141->16142 16143 fd0d53-fd0d61 16141->16143 16142->16140 16143->16122 16143->16142 16150->16150 16151 fd0e1c-fd0e50 call f92830 16150->16151 16154 fd0e54-fd0e5f 16151->16154 16154->16154 16155 fd0e61-fd0e89 16154->16155 16156 fd0e90-fd0e95 16155->16156 16156->16156 16157 fd0e97-fd0ecb call f92830 call ffcfd0 16156->16157 16162 fd0ecd-fd0edc 16157->16162 16163 fd0efc-fd0fc1 call ff38b0 call 106ce31 call ff5e10 16157->16163 16165 fd0ede-fd0eec 16162->16165 16166 fd0ef2-fd0ef9 call 106d0b2 16162->16166 16174 fd0fc7-fd0fd2 16163->16174 16165->16122 16165->16166 16166->16163 16174->16174 16175 fd0fd4-fd0ffc 16174->16175 16176 fd1000-fd1005 16175->16176 16176->16176 16177 fd1007-fd103b call f92830 call ffcfd0 16176->16177 16182 fd103d-fd104c 16177->16182 16183 fd106c-fd10cf call ff38b0 16177->16183 16184 fd104e-fd105c 16182->16184 16185 fd1062-fd1069 call 106d0b2 16182->16185 16190 fd10d0-fd10db 16183->16190 16184->16122 16184->16185 16185->16183 16190->16190 16191 fd10dd-fd1112 call ff9ec0 call ff3230 call ff38b0 16190->16191 16198 fd1114-fd1122 call f927b0 16191->16198 16199 fd1127-fd115e call f92660 * 2 16191->16199 16198->16199 16199->15992
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,010C61C0,00000000), ref: 00FD0452
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Open
                                                                                                                                                                                                                                  • String ID: B@H$KGNC$KGNC$RZE$WIZY$WZFL$YUC$YUC$\C_J$\G^@$\G^@$\G^@$\G^@$bEHC$cannot use operator[] with a string argument with $nehz$nehz$nehz$o|}z$o|}z$te}z$te}z$te}z
                                                                                                                                                                                                                                  • API String ID: 71445658-3163795657
                                                                                                                                                                                                                                  • Opcode ID: bd80c239f31175a6174cae4071f9fda67f80d17bab037c3c5968778c5142b864
                                                                                                                                                                                                                                  • Instruction ID: c0a02ced30e2c7bb633a73918996e2353ef02d90a85d11b2fe1c0e8e79156a86
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bd80c239f31175a6174cae4071f9fda67f80d17bab037c3c5968778c5142b864
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F692BC70C0025C9EEF25CB64CC84BEDBBB9AF15304F1481DAD449A7292EB746B88DF61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FCD5A0 Relevance: 34.9, APIs: 7, Strings: 12, Instructions: 1648COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(?), ref: 00FCD730
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FCD760
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FCE2C6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FCE2D6
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FCEC6D
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FCD84C
                                                                                                                                                                                                                                    • Part of subcall function 00FFD850: Concurrency::cancel_current_task.LIBCPMT ref: 00FFD92D
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FCEC24
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesConcurrency::cancel_current_taskFile
                                                                                                                                                                                                                                  • String ID: X_CV$YMJK$Z^E$\C_J$fKJE$invalid stoi argument$jONA$stoi argument out of range$wIZY${EHZ${M^]${{]E
                                                                                                                                                                                                                                  • API String ID: 3826552558-1934692543
                                                                                                                                                                                                                                  • Opcode ID: a1d4291f9abec1236b2a4edd26d80ce16ed66c7ddcd4ad790a6a9b69e87aa263
                                                                                                                                                                                                                                  • Instruction ID: e355100b1d20304ed83ea4a0e302a2cf506207cd71a80d3122451be76d0a7fcc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a1d4291f9abec1236b2a4edd26d80ce16ed66c7ddcd4ad790a6a9b69e87aa263
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BEE22370D0025A8FEF18CF68CD89BEDBB75AF55304F14829CD049AB292DB749AC5DB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FC1010 Relevance: 30.7, Strings: 23, Instructions: 1965COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: DFM$DMH$A]U^$BFJX$BFJX$BFJX$H[vI$H[vI$H[vI$H[vI$J@}$J@}$KoZW$KoZW$R\YK$R\YK$YU]Z$YU]Z$YU]Z$[QEW$[QEW${dFI${dFI
                                                                                                                                                                                                                                  • API String ID: 0-2122256219
                                                                                                                                                                                                                                  • Opcode ID: 4fc24f07be1ae652124f10a6e1c3537e5e4984f7c03f2bd4b57b5356f4f421ac
                                                                                                                                                                                                                                  • Instruction ID: 15a9d5a3fa05c08a10969563ada63229b6debbd3a1b882e4daa81497afb07552
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4fc24f07be1ae652124f10a6e1c3537e5e4984f7c03f2bd4b57b5356f4f421ac
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0603EF31D002598BDF18CF68CD95BEEBBB1EF56300F14829DE449AB292D7349A85DF90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FBBA60 Relevance: 30.0, Strings: 22, Instructions: 2456COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                                                  • String ID: @\FA$BFJX$BFJX$BFJX$BOH$D^Fr$H[vI$H[vI$H[vI$KoZW$KoZW$NB^$R\YK$R\YK$R\YK$SGBO$TM[\$YU]Z$YU]Z$YU]Z$cannot use operator[] with a string argument with $iM]]
                                                                                                                                                                                                                                  • API String ID: 1620887387-2013181319
                                                                                                                                                                                                                                  • Opcode ID: 868bd20af0e839c7b32e2e9eafb17ee923d1a86411f5d9e80f7b4a9f6b37bea4
                                                                                                                                                                                                                                  • Instruction ID: 68c1e7c3095a9ad13a8a1ebda6fa89bb9b3f5af8eff228196e240c3431bb08f1
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 868bd20af0e839c7b32e2e9eafb17ee923d1a86411f5d9e80f7b4a9f6b37bea4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6B230270D002598BDF29CF68CC847EEBBB5AF55300F1482D8D449AB292EB749B85DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FE82E0 Relevance: 26.9, APIs: 6, Strings: 9, Instructions: 699COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesCreateDirectoryFile
                                                                                                                                                                                                                                  • String ID: \Q^$\Q^$\Q^$\Q^$\Q^$\Q^$\Q^$@EH]$@EH]$@EH]$@^uS$@^uS$@^uS$@^uS$BPYC$BPYC$BPYC$BPYC$BPYu$BPYu$BPYu$BPYu$C@M$CGDK$CGDK$DI[N$DI[N$DJDB$DJDB$E@BO$E@BO$EM@K$EM@K$FCCZ$FCCZ$G@X#$IAJA$IAJA$IIDO$IIDO$IIDO$IIDO$IIDO$IIDO$KIZ^$KIZ^$LQCV$LQCV$MUC$MUC$O\]Z$QIE_$QIE_$RIL\$RIL\$RZE$RZE$RZE$RZE$SADO$SADO$SGBO$TMJ_$TMJ_$TM[\$WI]B$WI]B$WI]B$WI]B$WI]B$X!'$X&'$YMYG$YMYG$YMYG$YMYG$\_H\$\_H\$\_H\$\_H\$\_H\$_C_W$_TY$aiey$aiey$dBAW$dBAW$sz|o$sz|o$sz|o$tBXC$tBXC$tCCq$tCCq$tJB[$tJB[$type must be boolean, but is ${`@Y${`@Y${j[E${j[E${j[E${j[E${j[E${kFE${kFE${kFE${kj${lF]${lF]
                                                                                                                                                                                                                                  • API String ID: 3883471643-3051686586
                                                                                                                                                                                                                                  • Opcode ID: 82d73ece6044c128a4ac9cadc3306cc1907419e723e1d2b6c554278fa940dab4
                                                                                                                                                                                                                                  • Instruction ID: 313bc6d25171079e41f01e0c7cfe9a316018950a5206bcd99fbad83f7191f596
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 82d73ece6044c128a4ac9cadc3306cc1907419e723e1d2b6c554278fa940dab4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A4521370D002988EEF29DF69CC447EDBBB5AF02300F14819DD449A7292DB759E8ADF61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FC8C90 Relevance: 26.9, Strings: 20, Instructions: 1892COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: @^uS$B@H$BI^$BI^$BPYC$CGDK$DGFA$DGFA$IIDO$MEAK$O\]Z$QIE_$TMJ_$WI]B$YMYG$cannot use operator[] with a string argument with $dBAW$wI]B$wZFL${X[E
                                                                                                                                                                                                                                  • API String ID: 0-799835013
                                                                                                                                                                                                                                  • Opcode ID: ffb887cf63d5be59b71e5792a9fafd4292c6c007e84851cb627d9db20d573145
                                                                                                                                                                                                                                  • Instruction ID: aecd9979d69c5069d03e5c30fd75b1410501d138c2af585251e2cc8e8476307a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ffb887cf63d5be59b71e5792a9fafd4292c6c007e84851cb627d9db20d573145
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F403FF70D0425ACBEB25CF24CD49BEEBBB4AF15304F1441DCD489A7282EB75AA84DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FE3910 Relevance: 25.2, Strings: 19, Instructions: 1493COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock$AttributesConcurrency::cancel_current_taskCreateDirectoryFile
                                                                                                                                                                                                                                  • String ID: /$@WK^$B@H$B@H$KGNCE$KGNCE$RZE$RZE$WIZY\C_J$WIZY\C_J$WZFL$WZFL$X[B\$wZFLB@H]${${${NFR${XHY${j[E\_H\\
                                                                                                                                                                                                                                  • API String ID: 1266625421-4007018601
                                                                                                                                                                                                                                  • Opcode ID: 01976113b3dc907ff4daf8be38ec9aec01ed5928d2b35ab28f1e05bb5509c359
                                                                                                                                                                                                                                  • Instruction ID: fae1cf34285ce5d07aba12215f81a2bef08aefc6b9a3d1d6e818928833c6053b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 01976113b3dc907ff4daf8be38ec9aec01ed5928d2b35ab28f1e05bb5509c359
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BEE27C70D0025D9ADF25EBA0CC56BEDBB74AF15304F404498E549772A2EF782B88EF61
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FC7660 Relevance: 21.5, Strings: 16, Instructions: 1514COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: /,ms$AAEO$AAEO$B@H$HI^$K]D$MEAK$RZE$WI]B$\A][$cannot use operator[] with a string argument with $g`)#$wI]B$wZFL${XEK${X[E
                                                                                                                                                                                                                                  • API String ID: 0-3574655591
                                                                                                                                                                                                                                  • Opcode ID: c51f2eda88ec6f7ae3e6c12867d92575be34502714f996d8efd2217c460bc10d
                                                                                                                                                                                                                                  • Instruction ID: 8a4bc9b018f90fe1adf4024b5ab7ed5a4cd1401ebe0a7bdee5cffbdf0b9fd98e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c51f2eda88ec6f7ae3e6c12867d92575be34502714f996d8efd2217c460bc10d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 92D21370D002598FEB28CB24CD45BEEBBB4AF55304F1442DCD449AB282DB74AE89DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FBDE70 Relevance: 20.8, Strings: 15, Instructions: 2083COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                                                  • String ID: OUSY$OUSY$OYSM$RRZM$RRZM$RT]X$RT]X$d]MN$d]MN$yicz$yicz$yicz${k|x${k|x${k|x
                                                                                                                                                                                                                                  • API String ID: 1620887387-3943848870
                                                                                                                                                                                                                                  • Opcode ID: 4ea48d34ba7dd7543778e2778e1ea84d444759bac456860b1d0d79b787e65a45
                                                                                                                                                                                                                                  • Instruction ID: 7ca2b2c9c9ec5810c0a51bd9e4e33d4216085dc0228c22dccf713b2f35099911
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4ea48d34ba7dd7543778e2778e1ea84d444759bac456860b1d0d79b787e65a45
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4913F070D002588BEF19CF68CD94BEDBBB5AF55300F1082D8E4496B292D7749B89DFA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FC6590 Relevance: 18.7, Strings: 14, Instructions: 1195COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock
                                                                                                                                                                                                                                  • String ID: &$$=$;?#+$B@H$F]]E$F]]E$IIDO$MEAB$MEAK$QIE_$^L\$cannot use operator[] with a string argument with $wI]B$wZFL${X[E
                                                                                                                                                                                                                                  • API String ID: 1418687624-882675722
                                                                                                                                                                                                                                  • Opcode ID: b9e358af9d32dd695e5c5a2f9e7f7a510ef0836e34eae9ff312ca7afbabc0dbf
                                                                                                                                                                                                                                  • Instruction ID: aad3c6e48be252eb7e1669fe214accc8fc253621e70c1c7c72fd8e500110016a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b9e358af9d32dd695e5c5a2f9e7f7a510ef0836e34eae9ff312ca7afbabc0dbf
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 25B21370D0425A8FEB24DF24CD45BEEBBB4AF15304F1481DCD449AB282EB759A88DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FBA760 Relevance: 15.4, APIs: 1, Strings: 7, Instructions: 1391COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FBB648
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                                                                  • String ID: D^T$D^T$OAZ^$OAZ^$RZE$SADO$cannot use operator[] with a string argument with
                                                                                                                                                                                                                                  • API String ID: 885266447-1753538930
                                                                                                                                                                                                                                  • Opcode ID: b87e6093666d0943c5b8df26b5bf4252c407a7de0042ca070cf1760766540808
                                                                                                                                                                                                                                  • Instruction ID: 408cca5588fbfe4fd780273d3e4ea8fe7e02655c19dd7034f5132c8c8eda4248
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b87e6093666d0943c5b8df26b5bf4252c407a7de0042ca070cf1760766540808
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E1C20371D002598FDB28CF69CC847EDBBB1BF55300F148298D489AB282DB74AE85DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FC02C0 Relevance: 11.5, APIs: 1, Strings: 5, Instructions: 975COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::locale::_Init.LIBCPMT ref: 00FC097E
                                                                                                                                                                                                                                    • Part of subcall function 00FF91D0: std::_Lockit::_Lockit.LIBCPMT ref: 00FF91FE
                                                                                                                                                                                                                                    • Part of subcall function 00FF91D0: std::_Lockit::_Lockit.LIBCPMT ref: 00FF9221
                                                                                                                                                                                                                                    • Part of subcall function 00FF91D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00FF9241
                                                                                                                                                                                                                                    • Part of subcall function 00FF91D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00FF9275
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Lockitstd::_$Lockit::_Lockit::~_$Initstd::locale::_
                                                                                                                                                                                                                                  • String ID: BEHC$EM@K$HYOM$R[LX$n:
                                                                                                                                                                                                                                  • API String ID: 1226965381-3806352440
                                                                                                                                                                                                                                  • Opcode ID: cc416601fe1213c1b2b84fcb95b868f1f7048b2fef9fe59024c0527e9971a542
                                                                                                                                                                                                                                  • Instruction ID: 464f22d29400ae7052105e26d8ed3062f7db1fedeb817e88f2b6c5638e81a1fc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: cc416601fe1213c1b2b84fcb95b868f1f7048b2fef9fe59024c0527e9971a542
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ED822270D00249CBDF18DF68CD85BEDBBB1BF15304F14829CE445AB292DB74AA86DB91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FB0780 Relevance: 11.2, Strings: 8, Instructions: 1243COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: F]]E$F]]E$IIDO$KGNC$MEAB$MEAB$QIE_$cannot use operator[] with a string argument with
                                                                                                                                                                                                                                  • API String ID: 0-1760980718
                                                                                                                                                                                                                                  • Opcode ID: f7c319305b47bd09a8e36f577a8e6bdf1bf50fb8b4aae8c24bdde19bb4f98282
                                                                                                                                                                                                                                  • Instruction ID: c67514f2407a1631fcd0b188831347566088c31f94973ca44c42228727ead5aa
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f7c319305b47bd09a8e36f577a8e6bdf1bf50fb8b4aae8c24bdde19bb4f98282
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 6CB20570D00259DFEB25CF68CD44BEDFBB1AF55300F148298D489AB282DB74AA85DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00F9C050 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 262COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 23221 f9c050-f9c088 call 106c3b3 23224 f9c08e-f9c0c7 23221->23224 23225 f9c412-f9c413 call 106c05c 23221->23225 23226 f9c418 call f92040 23224->23226 23227 f9c0cd-f9c156 call ffd850 FindFirstFileA 23224->23227 23225->23226 23232 f9c41d-f9c422 call 1072350 23226->23232 23237 f9c369 23227->23237 23238 f9c15c 23227->23238 23239 f9c36b-f9c371 23237->23239 23240 f9c160-f9c169 23238->23240 23241 f9c39f-f9c3b7 23239->23241 23242 f9c373-f9c37f 23239->23242 23243 f9c170-f9c175 23240->23243 23244 f9c3b9-f9c3c5 23241->23244 23245 f9c3e1-f9c411 call 106c3c4 23241->23245 23246 f9c381-f9c38f 23242->23246 23247 f9c395-f9c39c call 106d0b2 23242->23247 23243->23243 23248 f9c177-f9c1c3 23243->23248 23250 f9c3d7-f9c3de call 106d0b2 23244->23250 23251 f9c3c7-f9c3d5 23244->23251 23246->23232 23246->23247 23247->23241 23248->23226 23258 f9c1c9-f9c29c call ffd850 call ff5b20 call ff5c90 23248->23258 23250->23245 23251->23232 23251->23250 23269 f9c2bc-f9c2d5 23258->23269 23270 f9c29e-f9c2a5 call f9c050 23258->23270 23273 f9c2db-f9c2ef 23269->23273 23274 f9c35f-f9c367 23269->23274 23270->23269 23273->23274 23277 f9c2f1-f9c302 FindNextFileA 23273->23277 23274->23239 23277->23240 23278 f9c308-f9c31a 23277->23278 23278->23239 23281 f9c31c-f9c322 23278->23281 23282 f9c324 23281->23282 23283 f9c326-f9c334 SetFileAttributesA 23281->23283 23282->23283 23284 f9c341-f9c345 23283->23284 23285 f9c336-f9c33f 23283->23285 23286 f9c349-f9c352 RemoveDirectoryA 23284->23286 23287 f9c347 23284->23287 23285->23239 23286->23237 23288 f9c354-f9c35d 23286->23288 23287->23286 23288->23239
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: \*.*
                                                                                                                                                                                                                                  • API String ID: 0-1173974218
                                                                                                                                                                                                                                  • Opcode ID: 8c851c100e8f9d0f4bc2d4d0807ad68dc050d1f5ef2f16f36cd3dd2a48a221f4
                                                                                                                                                                                                                                  • Instruction ID: 88455b2987e3ca23b26dffef24eabd5d72b979a4b3846e965d9812fcbb8b98a3
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8c851c100e8f9d0f4bc2d4d0807ad68dc050d1f5ef2f16f36cd3dd2a48a221f4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DE91D230E002099FFF14DBA8C954BEEB7B5EF15704F204658E491B7692DB71AE84DBA0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0106A930 Relevance: 9.2, Strings: 7, Instructions: 490COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 23438 106a930-106a94e call 1069430 23441 106a954-106a95d 23438->23441 23442 106afb1-106afb7 23438->23442 23443 106a963-106a969 23441->23443 23444 106a95f-106a961 23441->23444 23446 106a96f-106a980 23443->23446 23447 106a96b-106a96d 23443->23447 23445 106a983-106a989 23444->23445 23448 106a993-106a99a 23445->23448 23449 106a98b-106a991 23445->23449 23446->23445 23447->23445 23450 106a9a2-106a9b9 call 101b6e0 23448->23450 23451 106a99c 23448->23451 23449->23450 23454 106af96 23450->23454 23455 106a9bf-106a9d1 call 106f090 23450->23455 23451->23450 23457 106af98 23454->23457 23460 106a9d7-106a9de 23455->23460 23461 106aa75-106aa7a 23455->23461 23459 106af9f-106afa7 call 1069f70 23457->23459 23468 106afa9-106afaf 23459->23468 23465 106a9e0-106a9e7 23460->23465 23466 106a9e9-106a9f9 23460->23466 23463 106aa86-106ab3e call 101b260 23461->23463 23464 106aa7c-106aa83 23461->23464 23478 106ab56-106abc5 call 106a790 * 4 23463->23478 23479 106ab40-106ab51 call 101da80 23463->23479 23464->23463 23470 106a9fb-106aa02 23465->23470 23466->23461 23466->23470 23468->23442 23472 106aa64-106aa6b 23470->23472 23473 106aa04-106aa0b 23470->23473 23483 106aa6e-106aa70 23472->23483 23476 106aa17-106aa51 23473->23476 23477 106aa0d-106aa14 23473->23477 23476->23483 23496 106aa53-106aa5f 23476->23496 23477->23476 23492 106af22-106af27 23478->23492 23508 106abcb-106ac13 call 1046960 call 106a790 23478->23508 23489 106af20 23479->23489 23483->23457 23489->23492 23493 106af33-106af3b 23492->23493 23494 106af29-106af30 23492->23494 23498 106af66-106af6c 23493->23498 23499 106af3d-106af42 23493->23499 23494->23493 23496->23457 23498->23457 23503 106af6e-106af7a 23498->23503 23499->23498 23502 106af44-106af49 23499->23502 23502->23498 23506 106af4b-106af65 23502->23506 23503->23459 23507 106af7c-106af7e 23503->23507 23507->23468 23509 106af80-106af95 23507->23509 23514 106ac15-106ac18 23508->23514 23515 106ac1a-106ac20 23508->23515 23514->23515 23516 106ac26-106ac37 call 10267a0 23514->23516 23515->23516 23519 106adc5-106addf call 101da80 23516->23519 23520 106ac3d-106ac45 23516->23520 23519->23489 23521 106adbd-106adbf 23520->23521 23522 106ac4b-106ac5f 23520->23522 23521->23519 23525 106ac74-106acc4 call 1046f10 * 2 23521->23525 23522->23521 23524 106ac65-106ac71 23522->23524 23524->23525 23525->23492 23532 106acca-106acf5 call 101da80 call 106a610 23525->23532 23537 106ad93-106ada1 23532->23537 23538 106acfb 23532->23538 23540 106ada7-106adac 23537->23540 23541 106aed9-106aee1 23537->23541 23539 106ad00-106ad04 23538->23539 23539->23539 23542 106ad06-106ad17 23539->23542 23545 106adb0-106adb7 23540->23545 23543 106aee3-106aee8 23541->23543 23544 106aef1-106aef5 23541->23544 23546 106ad23-106ad3b call 1046bb0 23542->23546 23547 106ad19-106ad20 23542->23547 23543->23544 23548 106aeea-106aeef 23543->23548 23544->23489 23549 106aef7-106aefd 23544->23549 23550 106ade4-106adf3 23545->23550 23551 106adb9-106adbb 23545->23551 23563 106ad3d-106ad56 call 106a610 23546->23563 23564 106ad59-106ad5f 23546->23564 23547->23546 23548->23489 23548->23544 23549->23489 23553 106aeff-106af18 call 101da80 call 1069bc0 23549->23553 23554 106adff-106ae05 23550->23554 23561 106adf5-106adfc 23550->23561 23551->23554 23579 106af1d 23553->23579 23556 106ae07-106ae0c 23554->23556 23557 106ae0e-106ae13 23554->23557 23562 106ae16-106ae18 23556->23562 23557->23562 23561->23554 23566 106ae24-106ae2b 23562->23566 23567 106ae1a-106ae21 23562->23567 23563->23564 23569 106ad76-106ad7e 23564->23569 23570 106ad61-106ad71 call 101da80 23564->23570 23576 106ae2d-106ae3e 23566->23576 23577 106ae59-106ae5b 23566->23577 23567->23566 23572 106ad80-106ad87 23569->23572 23573 106ad8a-106ad8d 23569->23573 23570->23569 23572->23573 23573->23537 23582 106ad8f 23573->23582 23591 106ae56 23576->23591 23592 106ae40-106ae53 call 101da80 23576->23592 23580 106ae5d-106ae64 23577->23580 23581 106aec8-106aed3 23577->23581 23579->23489 23586 106ae66-106ae6d 23580->23586 23587 106aebe 23580->23587 23581->23541 23581->23545 23582->23537 23589 106ae6f-106ae76 23586->23589 23590 106ae79-106aeb3 23586->23590 23593 106aec5 23587->23593 23589->23590 23590->23581 23599 106aeb5-106aebc 23590->23599 23591->23577 23592->23591 23593->23581 23599->23593
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
                                                                                                                                                                                                                                  • API String ID: 0-1885142750
                                                                                                                                                                                                                                  • Opcode ID: c955344217c7614fb8882ec28fa8a8f84796c5d7a63257c7d6884c736bb79a41
                                                                                                                                                                                                                                  • Instruction ID: da7a42e125de54659af8733ddaed141f7669dad284a5e6c6a2b9cca7dedc7f5f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c955344217c7614fb8882ec28fa8a8f84796c5d7a63257c7d6884c736bb79a41
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5802E5B0B00701DFE731AF59D885B6B7BE8BF40704F144468E5C6AB285E7BAE944CB91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FE3350 Relevance: 6.6, Strings: 5, Instructions: 334COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID: BI^$DGFA$F]]EMEAB$KGNCE_$OAZ^D^T
                                                                                                                                                                                                                                  • API String ID: 118556049-3591372289
                                                                                                                                                                                                                                  • Opcode ID: 8f1396f344f4dd21e3ea3fb6933884db47c70d8735de3e368b4d46853e87de33
                                                                                                                                                                                                                                  • Instruction ID: 5c3a6da6c533575425a46833583766532e2f6240151a5e6c88d9b0efb11a4888
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8f1396f344f4dd21e3ea3fb6933884db47c70d8735de3e368b4d46853e87de33
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 86E1B171D042888FCB15DBA8CC45BEEBBB5AF59300F18809DE449A7353DB385A48DF91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FC0890 Relevance: 2.1, APIs: 1, Instructions: 554COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                    • Part of subcall function 00F9B8E0: __fread_nolock.LIBCMT ref: 00F9B9CF
                                                                                                                                                                                                                                  • std::locale::_Init.LIBCPMT ref: 00FC097E
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Init__fread_nolockstd::locale::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 221842284-0
                                                                                                                                                                                                                                  • Opcode ID: fdc217dddeea3e3ae82e46dd33950dc8ea8d0ee3066cba97c1b1927d978504f3
                                                                                                                                                                                                                                  • Instruction ID: 13ecd7e4c8659ebbeb60ac7403a7c601319f9030e619ce9168c6c8d8653de92e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fdc217dddeea3e3ae82e46dd33950dc8ea8d0ee3066cba97c1b1927d978504f3
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7F222371D00209CBDF18DF68CD89BEDBBB1AF45304F14829CE449AB392DB749A85DB91
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 010245E0 Relevance: 2.0, APIs: 1, Instructions: 471COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01024A76
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 885266447-0
                                                                                                                                                                                                                                  • Opcode ID: 119a1234979b88bc1b3c7095d3a94fd2fb91bb3060b496cab3669c15acb9377a
                                                                                                                                                                                                                                  • Instruction ID: 5d1ecd7876b89bcb9be1ff1f14d6b65f909b5d7bb8a5e1e30bfc9f126bb65c7e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 119a1234979b88bc1b3c7095d3a94fd2fb91bb3060b496cab3669c15acb9377a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 12029E706047518FE7A5CF29C850B6BBBE5BF88304F0449ADE5CACB651E7B0E948CB52
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FAFFC0 Relevance: 1.6, APIs: 1, Instructions: 103encryptionCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FAFFF8
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CryptDataUnprotect
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 834300711-0
                                                                                                                                                                                                                                  • Opcode ID: 1e6d0a87d8c674cd454d1f56da5f40c086e72167934575f3fee6f4d644d9dcc1
                                                                                                                                                                                                                                  • Instruction ID: 7a0dc028348afa2488b4ffd9fcda18a8095a6d21872a28de87856bda130d7fd8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 1e6d0a87d8c674cd454d1f56da5f40c086e72167934575f3fee6f4d644d9dcc1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 83213A719043016BE614AA25DC41BAFB7E8EFD5760F048A2DF8C893280EE35E9459BD3
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0106B4E5 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,01002DBA,?,?), ref: 0106B500
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileFindFirst
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1974802433-0
                                                                                                                                                                                                                                  • Opcode ID: d0154bd4c67d70493455c2bad558fda42fee596a90ad329b300afc18c7694b87
                                                                                                                                                                                                                                  • Instruction ID: 66cc63e6e569bf7dc44d872de6f0a1dc7c7140d615f9e8e29aa1e0409128442e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0154bd4c67d70493455c2bad558fda42fee596a90ad329b300afc18c7694b87
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 3AE08CB2250108BEFB116F788C00EBBBB9CDF06320F000925BE94D20A0D632A96296A0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0107970D Relevance: .3, Instructions: 318COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 54f3e4987366e82ae8f8c3d80c6afebbe1693cb17b1eeced77c97118a03c9d91
                                                                                                                                                                                                                                  • Instruction ID: 59abcf8175f4d1210b861cd445c1f74eb234039dff0a295fcddf5eb8672381b6
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 54f3e4987366e82ae8f8c3d80c6afebbe1693cb17b1eeced77c97118a03c9d91
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: ACB1D270E0060BCBEBA5CE6CC5956BEBBE1BF04338F14069DD6E297690D731A601CB59
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FFC5A0 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 519COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 23291 ffc5a0-ffc5e4 23292 ffc5ea-ffc682 23291->23292 23293 ffca53-ffca8c call 1004680 call ffe780 23291->23293 23298 ffc697-ffc6d7 call ff7810 call ffebf0 23292->23298 23299 ffc684-ffc691 23292->23299 23302 ffcc1c-ffcc20 23293->23302 23303 ffca92-ffcb26 call ffdb10 call f98080 call ffe1c0 call 1005b10 23293->23303 23317 ffc6d9-ffc6ec 23298->23317 23318 ffc6f6-ffc71e call 1003580 call ffe780 23298->23318 23299->23298 23306 ffcc6d-ffcc72 23302->23306 23307 ffcc22-ffcc5f call ff7810 call ff38b0 23302->23307 23343 ffcb28-ffcb34 23303->23343 23344 ffcb54-ffcba2 call 106e254 * 2 23303->23344 23312 ffcc78 23306->23312 23313 ffc974-ffc986 23306->23313 23307->23313 23329 ffcc65 23307->23329 23322 ffcc80 call 1072350 23312->23322 23317->23318 23336 ffc8a9-ffc8b0 23318->23336 23337 ffc724-ffc7b8 call ffdb10 call f98080 call ffe1c0 call 1004640 23318->23337 23331 ffcc85 call 1072350 23322->23331 23329->23306 23335 ffcc8a-ffcc99 call 1072350 23331->23335 23354 ffcc9b-ffcca5 23335->23354 23355 ffccc3-ffccd6 23335->23355 23340 ffc989-ffc98c 23336->23340 23341 ffc8b6-ffc901 call ff7810 call ff38b0 * 2 23336->23341 23400 ffc7ba-ffc7c6 23337->23400 23401 ffc7e6-ffc831 call 106e254 * 2 23337->23401 23349 ffc98e-ffc9c5 call ff7810 call ff38b0 23340->23349 23350 ffc9ca-ffc9dd call ff38b0 23340->23350 23397 ffc903-ffc917 23341->23397 23398 ffc921-ffc93f call ff2fc0 * 2 23341->23398 23351 ffcb4a-ffcb51 call 106d0b2 23343->23351 23352 ffcb36-ffcb44 23343->23352 23378 ffcba4-ffcbb3 23344->23378 23379 ffcbd3-ffcbf2 23344->23379 23349->23350 23369 ffc9df-ffc9f3 23350->23369 23370 ffc9fd-ffca1b call ff2fc0 * 2 23350->23370 23351->23344 23352->23335 23352->23351 23363 ffccb9-ffccbb call 106d0b2 23354->23363 23364 ffcca7-ffccb5 23354->23364 23381 ffccc0 23363->23381 23371 ffccd7-ffccdf call 1072350 23364->23371 23372 ffccb7 23364->23372 23369->23370 23370->23313 23411 ffca21-ffca34 23370->23411 23372->23363 23386 ffcbc9-ffcbd0 call 106d0b2 23378->23386 23387 ffcbb5-ffcbc3 23378->23387 23379->23302 23389 ffcbf4-ffcc00 23379->23389 23381->23355 23386->23379 23387->23335 23387->23386 23395 ffcc12-ffcc19 call 106d0b2 23389->23395 23396 ffcc02-ffcc10 23389->23396 23395->23302 23396->23335 23396->23395 23397->23398 23398->23313 23423 ffc941-ffc954 23398->23423 23407 ffc7dc-ffc7e3 call 106d0b2 23400->23407 23408 ffc7c8-ffc7d6 23400->23408 23427 ffc85f-ffc87b 23401->23427 23428 ffc833-ffc83f 23401->23428 23407->23401 23408->23322 23408->23407 23416 ffc96a-ffc971 call 106d0b2 23411->23416 23417 ffca3a-ffca48 23411->23417 23416->23313 23417->23331 23422 ffca4e 23417->23422 23422->23416 23423->23416 23426 ffc956-ffc964 23423->23426 23426->23331 23426->23416 23427->23336 23429 ffc87d-ffc889 23427->23429 23430 ffc855-ffc85c call 106d0b2 23428->23430 23431 ffc841-ffc84f 23428->23431 23432 ffc89f-ffc8a6 call 106d0b2 23429->23432 23433 ffc88b-ffc899 23429->23433 23430->23427 23431->23322 23431->23430 23432->23336 23433->23322 23433->23432
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00FFC806
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00FFC81F
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00FFCB77
                                                                                                                                                                                                                                  • ___std_exception_destroy.LIBVCRUNTIME ref: 00FFCB90
                                                                                                                                                                                                                                  Strings
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ___std_exception_destroy
                                                                                                                                                                                                                                  • String ID: value
                                                                                                                                                                                                                                  • API String ID: 4194217158-494360628
                                                                                                                                                                                                                                  • Opcode ID: 31350dd8b4acd0d9fc1c8ae1fd974e231451a63aa98fdb00492b16df4e67b9d1
                                                                                                                                                                                                                                  • Instruction ID: 8ebdc7a43cbdb1f49b2310a4b207c0a9439b06fd82067071cfb3e46cfe64db56
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 31350dd8b4acd0d9fc1c8ae1fd974e231451a63aa98fdb00492b16df4e67b9d1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2522F170D0025C8FDB18CBA4C9947EDFBB5AF58300F148299E589A7392DB746A84DFA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FADBB0 Relevance: 6.1, APIs: 4, Instructions: 99networkCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 24084 fadbb0-fadbe2 WSAStartup 24085 fadbe8-fadc12 call f97d20 * 2 24084->24085 24086 fadcb6-fadcbf 24084->24086 24091 fadc1e-fadc64 24085->24091 24092 fadc14-fadc18 24085->24092 24094 fadcb0 24091->24094 24095 fadc66-fadc6c 24091->24095 24092->24086 24092->24091 24094->24086 24096 fadc6e 24095->24096 24097 fadcc4-fadcce 24095->24097 24098 fadc74-fadc88 socket 24096->24098 24097->24094 24101 fadcd0-fadcd8 24097->24101 24098->24094 24100 fadc8a-fadc9a connect 24098->24100 24102 fadc9c-fadca4 closesocket 24100->24102 24103 fadcc0 24100->24103 24102->24098 24104 fadca6-fadcaa 24102->24104 24103->24097 24104->24094
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WSAStartup.WS2_32(00000202,?,?,?), ref: 00FADBDA
                                                                                                                                                                                                                                  • socket.WS2_32(?,?,?,?,?,?), ref: 00FADC7E
                                                                                                                                                                                                                                  • connect.WS2_32(00000000,?,?,?,?,?), ref: 00FADC92
                                                                                                                                                                                                                                  • closesocket.WS2_32(00000000), ref: 00FADC9D
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Startupclosesocketconnectsocket
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3098855095-0
                                                                                                                                                                                                                                  • Opcode ID: c650a708f05499d20eb231ee2739b8de15b1c9a518d1b121eff422e334c8891e
                                                                                                                                                                                                                                  • Instruction ID: b98c557e21b9de0ce48f3a24909a8d01f3f8b706c90ac91f08a01313fef47ba7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c650a708f05499d20eb231ee2739b8de15b1c9a518d1b121eff422e334c8891e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EA3104B29053116BD7209B28CC4562FB7E4FF8A334F515F19F9A5926E0E371E804D692
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00F9B8E0 Relevance: 4.9, APIs: 3, Instructions: 443COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 24105 f9b8e0-f9b93d 24106 f9b944-f9b94f 24105->24106 24106->24106 24107 f9b951-f9b972 call 1072f00 24106->24107 24110 f9b9dd-f9b9e4 24107->24110 24111 f9b974-f9b99c call 1076cd6 call 1072a8b call 1076cd6 24107->24111 24113 f9ba0e-f9ba1e 24110->24113 24114 f9b9e6-f9b9f2 24110->24114 24129 f9b99e-f9b9a4 24111->24129 24130 f9b9b1-f9b9b8 call ff86d0 24111->24130 24116 f9ba04-f9ba0b call 106d0b2 24114->24116 24117 f9b9f4-f9ba02 24114->24117 24116->24113 24117->24116 24119 f9ba1f-f9ba6d call 1072350 call ff9df0 24117->24119 24131 f9ba74-f9ba7f 24119->24131 24132 f9b9a8-f9b9af 24129->24132 24133 f9b9a6 24129->24133 24137 f9b9bd 24130->24137 24131->24131 24135 f9ba81-f9baa2 call 1072f00 24131->24135 24136 f9b9c0-f9b9c6 24132->24136 24133->24132 24144 f9bb0a-f9bb11 24135->24144 24145 f9baa4-f9bace call 1076cd6 call 1072a8b call 1076cd6 24135->24145 24138 f9b9c8 24136->24138 24139 f9b9ca-f9b9cf call 107b77f 24136->24139 24137->24136 24138->24139 24143 f9b9d4-f9b9da call 1076788 24139->24143 24143->24110 24148 f9bb3b-f9bb4b 24144->24148 24149 f9bb13-f9bb1f 24144->24149 24165 f9bae0-f9bae7 call ff86d0 24145->24165 24166 f9bad0-f9bad4 24145->24166 24152 f9bb31-f9bb38 call 106d0b2 24149->24152 24153 f9bb21-f9bb2f 24149->24153 24152->24148 24153->24152 24155 f9bb4c-f9bb9d call 1072350 call ff9df0 24153->24155 24168 f9bba4-f9bbaf 24155->24168 24171 f9baec-f9baf2 24165->24171 24169 f9bad8-f9bade 24166->24169 24170 f9bad6 24166->24170 24168->24168 24172 f9bbb1-f9bbd2 call 1072f00 24168->24172 24169->24171 24170->24169 24173 f9baf4 24171->24173 24174 f9baf6-f9bafb call 107b77f 24171->24174 24179 f9bc44-f9bc4b 24172->24179 24180 f9bbd4-f9bc08 call 1076cd6 call 1072a8b call 1076cd6 24172->24180 24173->24174 24178 f9bb00-f9bb09 call 1076788 24174->24178 24178->24144 24183 f9bc4d-f9bc59 24179->24183 24184 f9bc75-f9bc85 24179->24184 24199 f9bc1a-f9bc21 call ff86d0 24180->24199 24200 f9bc0a-f9bc0e 24180->24200 24187 f9bc6b-f9bc72 call 106d0b2 24183->24187 24188 f9bc5b-f9bc69 24183->24188 24187->24184 24188->24187 24189 f9bc86-f9bc9e call 1072350 24188->24189 24198 f9bca0-f9bcab 24189->24198 24198->24198 24201 f9bcad-f9bcce call 1072f00 24198->24201 24206 f9bc26-f9bc2c 24199->24206 24202 f9bc10 24200->24202 24203 f9bc12-f9bc18 24200->24203 24210 f9bceb-f9bcf2 24201->24210 24211 f9bcd0-f9bce8 call 1076cd6 call 1072a8b call 1076788 24201->24211 24202->24203 24203->24206 24208 f9bc2e 24206->24208 24209 f9bc30-f9bc3b call 107b77f call 1076788 24206->24209 24208->24209 24226 f9bc40-f9bc43 24209->24226 24212 f9bd1c-f9bd22 24210->24212 24213 f9bcf4-f9bd00 24210->24213 24211->24210 24216 f9bd12-f9bd19 call 106d0b2 24213->24216 24217 f9bd02-f9bd10 24213->24217 24216->24212 24217->24216 24220 f9bd23-f9bd4e call 1072350 24217->24220 24233 f9bd5f-f9bd64 24220->24233 24234 f9bd50-f9bd54 24220->24234 24226->24179 24234->24233 24235 f9bd56-f9bd5e 24234->24235
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: __fread_nolock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2638373210-0
                                                                                                                                                                                                                                  • Opcode ID: 5fa35c90269af43374010b3b965c9516a3aa4af2577455b91aaac760a4f46238
                                                                                                                                                                                                                                  • Instruction ID: 5832c7d67c016aca2c78cf9175feaf23e09684473c11a1f7dd4af4aacf49d5ed
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5fa35c90269af43374010b3b965c9516a3aa4af2577455b91aaac760a4f46238
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B3D16A71A00209ABEF28DF68DD85BAFB7A8EF44710F20462DF4459B281DBB59A41C794
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FA4540 Relevance: 4.8, APIs: 3, Instructions: 331fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 24236 fa4540-fa459e 24237 fa45a5-fa45aa 24236->24237 24237->24237 24238 fa45ac-fa45df call f92830 24237->24238 24241 fa45e0-fa45e5 24238->24241 24241->24241 24242 fa45e7-fa465a call f92830 call f9c430 call f9c790 24241->24242 24249 fa4660-fa4665 24242->24249 24249->24249 24250 fa4667-fa4672 24249->24250 24251 fa4678-fa470a call ffd850 call ffd660 call ff5b90 24250->24251 24252 fa4952 call f92040 24250->24252 24266 fa4738-fa4754 24251->24266 24267 fa470c-fa4718 24251->24267 24256 fa4957 call 1072350 24252->24256 24259 fa495c-fa495d call 106c05c 24256->24259 24263 fa4962-fa4967 call 1072350 24259->24263 24271 fa4756-fa4765 24266->24271 24272 fa4785-fa478f 24266->24272 24269 fa471a-fa4728 24267->24269 24270 fa472e-fa4735 call 106d0b2 24267->24270 24269->24256 24269->24270 24270->24266 24276 fa477b-fa4782 call 106d0b2 24271->24276 24277 fa4767-fa4775 24271->24277 24273 fa47bd-fa47e6 CopyFileA 24272->24273 24274 fa4791-fa479d 24272->24274 24281 fa47e8-fa4806 call f9aba0 CopyFileA 24273->24281 24282 fa481f-fa482e call 106c3b3 24273->24282 24279 fa479f-fa47ad 24274->24279 24280 fa47b3-fa47ba call 106d0b2 24274->24280 24276->24272 24277->24256 24277->24276 24279->24256 24279->24280 24280->24273 24281->24282 24292 fa4808-fa4810 call 106a930 24281->24292 24282->24259 24291 fa4834-fa4847 call 106a930 24282->24291 24295 fa484c-fa4874 call ff5e10 24291->24295 24296 fa4815-fa481a 24292->24296 24304 fa48a2-fa48af call 1002570 24295->24304 24305 fa4876-fa48a0 24295->24305 24298 fa48f3-fa48f9 24296->24298 24299 fa48fb-fa4907 24298->24299 24300 fa4923-fa4951 call ff8000 24298->24300 24302 fa4919-fa4920 call 106d0b2 24299->24302 24303 fa4909-fa4917 24299->24303 24302->24300 24303->24263 24303->24302 24308 fa48b2-fa48b5 24304->24308 24305->24308 24313 fa48e6-fa48f0 call 106c3c4 24308->24313 24314 fa48b7-fa48c6 24308->24314 24313->24298 24316 fa48c8-fa48d6 24314->24316 24317 fa48dc-fa48e3 call 106d0b2 24314->24317 24316->24263 24316->24317 24317->24313
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CopyFileA.KERNEL32(?,?,00000000,?,?,?,?,?,?,010C3BA4,00000000,?,?), ref: 00FA47DE
                                                                                                                                                                                                                                  • CopyFileA.KERNEL32(?,?,00000000), ref: 00FA47FE
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00FA48EB
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CopyFile$Mtx_unlock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 741997458-0
                                                                                                                                                                                                                                  • Opcode ID: a0e6df0c1f65ef8bb64de1e5a3e8eff00ec776e70e144e8a6d0891c0fdbebc9c
                                                                                                                                                                                                                                  • Instruction ID: 187c39d1b8c86db5a1caca641b4f109449b563f938d982a0c4ce9f8f8b4059a5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a0e6df0c1f65ef8bb64de1e5a3e8eff00ec776e70e144e8a6d0891c0fdbebc9c
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FBC13570D002098FEF18DFA8CD44BAEB7B5FF96300F24825CE44567292D7756A85DBA1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 010821C3 Relevance: 3.3, APIs: 2, Instructions: 297COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 24508 10821c3-10821d3 24509 10821ed-10821ef 24508->24509 24510 10821d5-10821e8 call 107adcc call 107addf 24508->24510 24511 108252f-108253c call 107adcc call 107addf 24509->24511 24512 10821f5-10821fb 24509->24512 24528 1082547 24510->24528 24531 1082542 call 1072340 24511->24531 24512->24511 24514 1082201-108222a 24512->24514 24514->24511 24517 1082230-1082239 24514->24517 24520 108223b-108224e call 107adcc call 107addf 24517->24520 24521 1082253-1082255 24517->24521 24520->24531 24526 108252b-108252d 24521->24526 24527 108225b-108225f 24521->24527 24529 108254a-108254d 24526->24529 24527->24526 24532 1082265-1082269 24527->24532 24528->24529 24531->24528 24532->24520 24535 108226b-1082282 24532->24535 24537 1082284-1082287 24535->24537 24538 10822b7-10822bd 24535->24538 24541 1082289-108228f 24537->24541 24542 10822ad-10822b5 24537->24542 24539 10822bf-10822c6 24538->24539 24540 1082291-10822a8 call 107adcc call 107addf call 1072340 24538->24540 24544 10822c8 24539->24544 24545 10822ca-10822e8 call 10849cd call 1084953 * 2 24539->24545 24569 1082462 24540->24569 24541->24540 24541->24542 24543 108232a-1082349 24542->24543 24548 108234f-108235b 24543->24548 24549 1082405-108240e call 108e8e4 24543->24549 24544->24545 24574 10822ea-1082300 call 107addf call 107adcc 24545->24574 24575 1082305-1082328 call 107bcdd 24545->24575 24548->24549 24553 1082361-1082363 24548->24553 24560 108247f 24549->24560 24561 1082410-1082422 24549->24561 24553->24549 24557 1082369-108238a 24553->24557 24557->24549 24562 108238c-10823a2 24557->24562 24566 1082483-1082499 ReadFile 24560->24566 24561->24560 24565 1082424-1082433 24561->24565 24562->24549 24567 10823a4-10823a6 24562->24567 24565->24560 24584 1082435-1082439 24565->24584 24570 108249b-10824a1 24566->24570 24571 10824f7-1082502 24566->24571 24567->24549 24572 10823a8-10823cb 24567->24572 24576 1082465-108246f call 1084953 24569->24576 24570->24571 24578 10824a3 24570->24578 24592 108251b-108251e 24571->24592 24593 1082504-1082516 call 107addf call 107adcc 24571->24593 24572->24549 24579 10823cd-10823e3 24572->24579 24574->24569 24575->24543 24576->24529 24586 10824a6-10824b8 24578->24586 24579->24549 24580 10823e5-10823e7 24579->24580 24580->24549 24587 10823e9-1082400 24580->24587 24584->24566 24591 108243b-1082453 24584->24591 24586->24576 24594 10824ba-10824be 24586->24594 24587->24549 24612 1082474-108247d 24591->24612 24613 1082455-108245a 24591->24613 24595 108245b-1082461 call 107ad85 24592->24595 24596 1082524-1082526 24592->24596 24593->24569 24599 10824c0-10824d0 call 1081ed5 24594->24599 24600 10824d7-10824e4 24594->24600 24595->24569 24596->24576 24616 10824d3-10824d5 24599->24616 24602 10824f0-10824f5 call 1081d1b 24600->24602 24603 10824e6 call 108202c 24600->24603 24617 10824eb-10824ee 24602->24617 24603->24617 24612->24586 24613->24595 24616->24576 24617->24616
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 3f8661fb70eae4ea9f97a39e490b4db7169c925383fd35539ac2cfc713d17582
                                                                                                                                                                                                                                  • Instruction ID: 4d0ccdf3b9c2e6a1de4a2623cffad02f0b25e2d2458b99c58ab733babd89e73d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3f8661fb70eae4ea9f97a39e490b4db7169c925383fd35539ac2cfc713d17582
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BAB1D170A0824AAFEB12FF9DC890BAD7BF1FF59314F145199D6C19B281CB709942CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FA4970 Relevance: 3.1, APIs: 2, Instructions: 127COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 24620 fa4970-fa498a call 106c3b3 24623 fa4ad3-fa4ad9 call 106c05c 24620->24623 24624 fa4990-fa49b6 24620->24624 24625 fa49b8-fa49ba 24624->24625 24626 fa49ec-fa49fb call 106c3c4 call 1069f70 24624->24626 24628 fa49c0-fa49c4 24625->24628 24636 fa4a00-fa4a06 24626->24636 24631 fa49c6-fa49ea 24628->24631 24632 fa4a07-fa4a2c call 1069f70 24628->24632 24631->24626 24631->24628 24638 fa4a2e 24632->24638 24639 fa4a30-fa4a4c call 107693e 24632->24639 24638->24639 24642 fa4a6e-fa4a74 24639->24642 24643 fa4a4e 24639->24643 24645 fa4a9e-fa4acd call 106c3c4 24642->24645 24646 fa4a76-fa4a80 24642->24646 24644 fa4a50-fa4a66 call ff5c90 24643->24644 24657 fa4a68 24644->24657 24648 fa4a82-fa4a90 24646->24648 24649 fa4a94-fa4a96 call 106d0b2 24646->24649 24652 fa4ace call 1072350 24648->24652 24653 fa4a92 24648->24653 24658 fa4a9b 24649->24658 24652->24623 24653->24649 24657->24642 24658->24645
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Mtx_unlock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1418687624-0
                                                                                                                                                                                                                                  • Opcode ID: c2074ea8ec06e913f6d6b124f0293e9745953ea8ef0fd492f5f54b9c414df911
                                                                                                                                                                                                                                  • Instruction ID: 1e907ef6d40ba955ecf52e2371b9c92eefacedfb846acbf7314339a81ccb0735
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c2074ea8ec06e913f6d6b124f0293e9745953ea8ef0fd492f5f54b9c414df911
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 37312872F001118BDB28DF68DC8466FB775AB81314B18413CE842AB346D67BAD41CBD5
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00F9BF90 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                                                                                                  Download Yara Rule

                                                                                                                                                                                                                                  Control-flow Graph

                                                                                                                                                                                                                                  • Executed
                                                                                                                                                                                                                                  • Not Executed
                                                                                                                                                                                                                                  control_flow_graph 24659 f9bf90-f9bfa7 call 106c3b3 24662 f9bfa9-f9bfab 24659->24662 24663 f9bffe-f9c004 call 106c05c 24659->24663 24664 f9bfad-f9bfaf 24662->24664 24665 f9bfe7 24662->24665 24668 f9bfb2-f9bfb7 24664->24668 24667 f9bfe9-f9bffd call 106c3c4 24665->24667 24668->24668 24671 f9bfb9-f9bfbb 24668->24671 24671->24665 24672 f9bfbd-f9bfc7 GetFileAttributesA 24671->24672 24674 f9bfc9-f9bfd2 24672->24674 24675 f9bfe3-f9bfe5 24672->24675 24674->24675 24677 f9bfd4-f9bfd7 24674->24677 24675->24667 24677->24675 24678 f9bfd9-f9bfdc 24677->24678 24678->24675 24679 f9bfde-f9bfe1 24678->24679 24679->24665 24679->24675
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetFileAttributesA.KERNEL32(?,?,787C6B7B), ref: 00F9BFBE
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00F9BFEE
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AttributesFileMtx_unlock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1424188087-0
                                                                                                                                                                                                                                  • Opcode ID: d0d95f9b9972c23350f7b217b32bd028f3a3ad8a0ef2a58ca8b1bc551215f0af
                                                                                                                                                                                                                                  • Instruction ID: 2508f2aab3df7cea91181e86644cb8e82d43610686b55ffccfba7d35d0a1b86d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0d95f9b9972c23350f7b217b32bd028f3a3ad8a0ef2a58ca8b1bc551215f0af
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: FCF04661E45121223C3721E53F89DBE620C89A773CB180616D881CA200DA03DD86AAA2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00F9C010 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateDirectoryA.KERNEL32(?,00000000,00000000,?,787C6B7B), ref: 00F9C026
                                                                                                                                                                                                                                  • __Mtx_unlock.LIBCPMT ref: 00F9C033
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateDirectoryMtx_unlock
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3577089425-0
                                                                                                                                                                                                                                  • Opcode ID: bcc86227687a19e982be9676908ba57a4fc1127a21ce0d0b7b53ac0c42457db5
                                                                                                                                                                                                                                  • Instruction ID: b9ff7d476651aa35439f3ad068834d0926ad5e5b798c65658e55fbb21219928c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bcc86227687a19e982be9676908ba57a4fc1127a21ce0d0b7b53ac0c42457db5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9BD0C9A2E4163523B93433B52E059EF504D4A329A5B09447AFDC4DB305EE56EE4445E2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01085309 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • DeleteFileW.KERNEL32(?,?,01076991,?), ref: 01085311
                                                                                                                                                                                                                                  • __dosmaperr.LIBCMT ref: 01085322
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: DeleteFile__dosmaperr
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1911827773-0
                                                                                                                                                                                                                                  • Opcode ID: 90f3d2a7cb348ba56bbcdd689dc064d24e034bd4bfa4194e338007fc18be3cde
                                                                                                                                                                                                                                  • Instruction ID: 6ceb3019511032bba525d6bd08b0c2f90240bdf19814ea9383e02f1339438a33
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 90f3d2a7cb348ba56bbcdd689dc064d24e034bd4bfa4194e338007fc18be3cde
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1DD0123169560876AE1135B96C0045A778DCBC227DB242691B8AC865E1EE66D8924061
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF0474 Relevance: 1.8, APIs: 1, Instructions: 298COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 965a612ff42423518c48f3a1b034fe40ac96e89b273d493000e76992471c54f2
                                                                                                                                                                                                                                  • Instruction ID: 24bf6a8a536b6438a939c0974050895feefdd3c0450437dd031d5e9aeb28be7c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 965a612ff42423518c48f3a1b034fe40ac96e89b273d493000e76992471c54f2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AB5145FB24C110BEB22391816E54AF7676DE6D2B30732842AF647D3503F3D4AE492470
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF04D3 Relevance: 1.8, APIs: 1, Instructions: 278COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: d7e0fd25bb520acb15d72b29b895356090de51f8d1f756deb147adfb3eb3f30e
                                                                                                                                                                                                                                  • Instruction ID: 4bb08a14edc2f83863b03e7bed32db3b1663b1c47c2ff3440d37f64d408259c7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d7e0fd25bb520acb15d72b29b895356090de51f8d1f756deb147adfb3eb3f30e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 675117EB34C111BDB53391816F54AFB672EE6D6730B32842AF687D3503F2D4AA492471
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF0507 Relevance: 1.8, APIs: 1, Instructions: 276COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: 27a880b786de8a8548d95752f188a4e6343cf0f48f52e917a17ead71ce678f15
                                                                                                                                                                                                                                  • Instruction ID: 448d1c1b1df9b18d185b6f2574c4639a9cff549f9ba6c123ba43fd3bdac57345
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 27a880b786de8a8548d95752f188a4e6343cf0f48f52e917a17ead71ce678f15
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 805126EB34C110BEB62391916E54AFB672EE6D27707328426F687D7503F294AE492470
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF04EB Relevance: 1.8, APIs: 1, Instructions: 270COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 3551e43079082ac46f08da7664ec9d07d9b3e289c689fca34a2e8f62d981cce4
                                                                                                                                                                                                                                  • Instruction ID: 467968251f4a2ca332578def1a4e01735257b1db2c6dc1293011bab6847a1d36
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3551e43079082ac46f08da7664ec9d07d9b3e289c689fca34a2e8f62d981cce4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B95126EB34C110BDB63391812F54AF6672EE6D6730B328466F687D3503F2D4AA492071
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D40377 Relevance: 1.8, APIs: 1, Instructions: 269fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 4daf750c80bd3c9e60b88c034d67e500d0eb1b9ffab156218dae128d1b5bbd44
                                                                                                                                                                                                                                  • Instruction ID: 6318057b1843d309a0e750932797a650809cf07d579f77add0fde53f18bdfd1e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4daf750c80bd3c9e60b88c034d67e500d0eb1b9ffab156218dae128d1b5bbd44
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D75171FB30C151BFB24385912B14EFB6B6ED5C6730331C82BFA83D5402F2989A492172
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D40348 Relevance: 1.8, APIs: 1, Instructions: 268fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: e0bfbf0c72a47b18230b68d2ad3cc5d63c2623e18f33d5ded40e9b90a68a9dde
                                                                                                                                                                                                                                  • Instruction ID: a2fe8c398e26ed702784026ded71177bc91f035e570e389341b1e86d23d5b98d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e0bfbf0c72a47b18230b68d2ad3cc5d63c2623e18f33d5ded40e9b90a68a9dde
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 455150FB30C161BFB64395912B14EFB676EE5C6730331C82BFA87D5502F2989A492531
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF054F Relevance: 1.8, APIs: 1, Instructions: 268COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: c8bf9d24779a8e8ee93a7e7033451a42c5ea1ec5bbaacc5961cff07e20e4500b
                                                                                                                                                                                                                                  • Instruction ID: 3567cd995cc6e04b9d20b925bf81412a6f7e9c3f5e3548d7aa64414cef3afe34
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8bf9d24779a8e8ee93a7e7033451a42c5ea1ec5bbaacc5961cff07e20e4500b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 305114EB24C110BEB52391816F54AFB672EE6D2730B32842AF687D3503F3D4AE492470
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF0500 Relevance: 1.8, APIs: 1, Instructions: 264COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: a49a78a3a19d3de7aa13c711dae2bbb09e53ae2f143f1142e7ce01ad34bfe195
                                                                                                                                                                                                                                  • Instruction ID: 99ee05823061d00faa516be85b2a90da6f35fbe8ebd2f00cd5ea0dc48d4c9f55
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a49a78a3a19d3de7aa13c711dae2bbb09e53ae2f143f1142e7ce01ad34bfe195
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 285105EB34C110BEB52391816F54AFB672EE6D6730B32842AF687D3503F2D4AE492471
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D40386 Relevance: 1.8, APIs: 1, Instructions: 259fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: edbe5041eb9111a544a8540cd8c832d202aa1c203d463a9a2a1e7726b5f726d7
                                                                                                                                                                                                                                  • Instruction ID: e30dcffc15a829a7cba1e83f36f4502a2c91e655c6cf83d79d645ed19ac00f2b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: edbe5041eb9111a544a8540cd8c832d202aa1c203d463a9a2a1e7726b5f726d7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A5151FB30C151BFB24385912B14EFB676ED5C6730331C82BFA87D5506F2999A4A2532
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D4039B Relevance: 1.8, APIs: 1, Instructions: 253fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 3e842f61ed88eebf41bf25191c85fe236935db3f184679d9d290e6c11c0a56dc
                                                                                                                                                                                                                                  • Instruction ID: 006605afbf2524b0f691eebc8d87fb47deb02e813eefbed04649dcc608d4fd94
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3e842f61ed88eebf41bf25191c85fe236935db3f184679d9d290e6c11c0a56dc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D0415EFB30C161BFB24385812B14EFB676ED5C6730331C82BFA87D5506F2989A492171
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FF3910 Relevance: 1.7, APIs: 1, Instructions: 246COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00FF3C1A
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: 80eb31e0803745ec74019e3a39bf6dbb4cd7de2ee97ed1a653360dcefb0ed9eb
                                                                                                                                                                                                                                  • Instruction ID: d3b7bd4d5c245133795aa297be19ccb751e5f4441ca4dc7f58191eb593c7577c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 80eb31e0803745ec74019e3a39bf6dbb4cd7de2ee97ed1a653360dcefb0ed9eb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 83B15AB5D002499FDB00CFA8C4807A9FBF5BF48314F28C1AED959AB352D775AA41DB90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D40359 Relevance: 1.7, APIs: 1, Instructions: 236fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 40cc181eb08c08559170218b8c7029fb03a8ac5f183a065179faf28247d67c2d
                                                                                                                                                                                                                                  • Instruction ID: e54172c73a00a05f2d874e75ab5e80f11347084f4d82ccb4bae0bf8253e6c50a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 40cc181eb08c08559170218b8c7029fb03a8ac5f183a065179faf28247d67c2d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5341C6FB30C151BFB243D6512B14AFB67AED5C6730331C82BFA87D6102F2A49A496171
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D403F7 Relevance: 1.7, APIs: 1, Instructions: 235fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 3cc86d2f3c841ab0401800842af724d5e1f33c73e4d83fa3e2d7fc2caeb5dc6d
                                                                                                                                                                                                                                  • Instruction ID: e76d2b9f94c549e46786076235397dcc0f74ed2d12be6d464863fdd6ac5875fc
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 3cc86d2f3c841ab0401800842af724d5e1f33c73e4d83fa3e2d7fc2caeb5dc6d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7541C3FB30C151BFB24386512B14AFB676EE5C6730331846BFA87D6502F2999A4A2132
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D403C1 Relevance: 1.7, APIs: 1, Instructions: 234fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 7e62a33d2926d885fe6cc485444883d170eab3e9aa2608002d81dfba8b704c99
                                                                                                                                                                                                                                  • Instruction ID: 00f4a48c23ad37953cd47a36de4c2b2a69cd6ca5c87befa6435c549a679f9ce2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7e62a33d2926d885fe6cc485444883d170eab3e9aa2608002d81dfba8b704c99
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 974182FB30C111BFB243D6912B14AFB67AEE5C6730331C43AFA87D1502F2A49A492131
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF056B Relevance: 1.7, APIs: 1, Instructions: 231COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: fc02d62aaf4d244fa50e145c5517d5e1a6e665f905f47125566d91ba97892925
                                                                                                                                                                                                                                  • Instruction ID: c1e72e9cf63b86a45415294ef8b01f130df199f5359beccded0344afd4606491
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fc02d62aaf4d244fa50e145c5517d5e1a6e665f905f47125566d91ba97892925
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 234158FB34C110BEB62391416F54AF7272EE6D6730B328426F687D3503F2D4AA8A2570
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D403E5 Relevance: 1.7, APIs: 1, Instructions: 225fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 31ed6e122dbea3bc85a5b72115926ac5bc744284cb966af5317b99497e45dedb
                                                                                                                                                                                                                                  • Instruction ID: 6bfce9c61de1cd0a20b4435a111a2496dd561b27e47250993d3f8833a43cb733
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 31ed6e122dbea3bc85a5b72115926ac5bc744284cb966af5317b99497e45dedb
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 314140FB34C151BFB24386912B14AFB676ED5C6730331C82BFA87D5502F2A49A492571
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF0595 Relevance: 1.7, APIs: 1, Instructions: 219COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: 8037a0d7e4f1f443bfd691dcbf0cfa3864b08a703b812f6cf9c4fd754f3e623e
                                                                                                                                                                                                                                  • Instruction ID: 571dc25153a30d04b551facff50a3170160829689e1e8b7c867cf5871ade4ef9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 8037a0d7e4f1f443bfd691dcbf0cfa3864b08a703b812f6cf9c4fd754f3e623e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: EC4138FB34C111BEB52395416F50AF7572EE6D6730B328426F687D3503F2949E8A2470
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D40411 Relevance: 1.7, APIs: 1, Instructions: 218fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: d0c01b88198e9b877de3cc9a77217d5d56e3f896a8c22b7c9f7709d4b690e05a
                                                                                                                                                                                                                                  • Instruction ID: a07ae6c8f5164ec3203b7e4cb3f6ec3d6ee79e9cbe8047d9301b15ed3a55d8b2
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d0c01b88198e9b877de3cc9a77217d5d56e3f896a8c22b7c9f7709d4b690e05a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5B4193FB20C151BFB243D6512B14AFB676ED6C6730731C427FA87D6102F2989A492531
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D4044E Relevance: 1.7, APIs: 1, Instructions: 208fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 59af387fa4705b93c17e67d5bf987cb481fd6af4f22a6484c2bb00217ad07cd8
                                                                                                                                                                                                                                  • Instruction ID: 438c1afe8d23a87b9af25052a88d19ace023549893890167a392243ba99bc51e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 59af387fa4705b93c17e67d5bf987cb481fd6af4f22a6484c2bb00217ad07cd8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9C41FAF730C1517FB743C5501A14AFA2B6ED5C77303318467FA87D6103F29999492671
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0108303C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 010831C1
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3934441357-0
                                                                                                                                                                                                                                  • Opcode ID: 59b6676627dc342212fc20c2b88f5c63d3b144a972d1426db9b23833a16ae4d2
                                                                                                                                                                                                                                  • Instruction ID: ae1d8f1ee936a3fc0fdc38429df25134a3d960253209cc007859f5c249e4e518
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 59b6676627dc342212fc20c2b88f5c63d3b144a972d1426db9b23833a16ae4d2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: B3619371D08119AEDF11EFA8C844AEEBFB9BB89B04F140195E9C4AB201D776D901CB60
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF05BF Relevance: 1.7, APIs: 1, Instructions: 193COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: e523f99eb006b9e62a58510e83c235501b3cb476ce6ffdeab09ed44cb1e067d0
                                                                                                                                                                                                                                  • Instruction ID: 3308299d7d03694758713d9fd74dadb3fd95c78e14a15db175bbcf5c4d151b21
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: e523f99eb006b9e62a58510e83c235501b3cb476ce6ffdeab09ed44cb1e067d0
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F3415BF734C115BEB53395416E50AF6272EE6D6730B328426F687D3503F394E98A25B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF0641 Relevance: 1.7, APIs: 1, Instructions: 188COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04DF06D4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: 5e78530e699c18e7eeb2d718518bc66d4a69ef0641c04b5407f41f6a3c6ba207
                                                                                                                                                                                                                                  • Instruction ID: ea414652deb2ee942c0c0421167743bd01b63ce9ad9b0db2926c66a87630fa87
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5e78530e699c18e7eeb2d718518bc66d4a69ef0641c04b5407f41f6a3c6ba207
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7A315AFB34C114BEB53395416E40AF6272EE6D67707728426F687D3503F390E98625B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF05F6 Relevance: 1.7, APIs: 1, Instructions: 183COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: a3fbfc8edc2e8607c8ffc7306443d750ce3374898bedc9b8021b920e0c3799b7
                                                                                                                                                                                                                                  • Instruction ID: a3f2d773ac87a430aead16d03814423da2baf267bb13fd744866c2cb5f0c342a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a3fbfc8edc2e8607c8ffc7306443d750ce3374898bedc9b8021b920e0c3799b7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0D3158FB30C115BEB633A5506E40AFA272EE6D6730B324466F687D3503F290A94625B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D4046A Relevance: 1.7, APIs: 1, Instructions: 179fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 5997c2d68645cd2646e2716e85b2c435ecfeb7b5afb7e918caaa467716c89e78
                                                                                                                                                                                                                                  • Instruction ID: 63411ad78cda629cac31de802341e4a48320d6197067efcfec4953ef2f33aecd
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5997c2d68645cd2646e2716e85b2c435ecfeb7b5afb7e918caaa467716c89e78
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: DB31B3F730C161BFB253C5512B14AFB67AED5C6730331886BFA83D6102F29899492171
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF060F Relevance: 1.7, APIs: 1, Instructions: 179COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: 6f5dff310c8b98b2b356f915fa75e30cfac21b7435817ca2a77ffbb4e79b7971
                                                                                                                                                                                                                                  • Instruction ID: d719817750476948ee84ce3714bfbdcb504cd85bfa6f52deb6966a2ff7e01142
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 6f5dff310c8b98b2b356f915fa75e30cfac21b7435817ca2a77ffbb4e79b7971
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 853167F730C110BEA63395406E50AF6277EE6D2730B32846AF687D7503F390E94A29B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF0684 Relevance: 1.7, APIs: 1, Instructions: 176COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04DF06D4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: a2ebecc748c1a46fc900269e1246d4abb80618ce04ff66033af5c65bcee7cdb9
                                                                                                                                                                                                                                  • Instruction ID: df5c3cf98e5c90ad50e7f9b11b622865ba0fef3f6f92937ce080f63b12b9e948
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a2ebecc748c1a46fc900269e1246d4abb80618ce04ff66033af5c65bcee7cdb9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 61316DE730C111BEB633A9506E54AF76B2DE6D2770732846AF687D7403F390E94625B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D404A0 Relevance: 1.7, APIs: 1, Instructions: 170fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: c2961181dd49a5adb4e237d37959a05afb9f2fe9d7ec50cb6f413903243ae309
                                                                                                                                                                                                                                  • Instruction ID: 6fcffc864b1d5cf8858b5a70d609da0b2c71426790919117a3a9a8def0ee201b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c2961181dd49a5adb4e237d37959a05afb9f2fe9d7ec50cb6f413903243ae309
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1631D2F730C161BFB243C6512B14AFA27AED5C6730331886AFA83D6506F298A94A6531
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF064F Relevance: 1.7, APIs: 1, Instructions: 167COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: 055248722e2b73de0de6db80cd75a4e738478698fb70ca4ca004f8acf018fbe5
                                                                                                                                                                                                                                  • Instruction ID: 7074586e3508e9050d9644d538c1651d658b16d5660dbc37ebdbb43f5392516e
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 055248722e2b73de0de6db80cd75a4e738478698fb70ca4ca004f8acf018fbe5
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1F318CEB30C111BEB233A5506E44AF7273DE6D2B307328826F683D7403F290E94628B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D404C9 Relevance: 1.7, APIs: 1, Instructions: 158fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: acb77376461bb9241e046e9ad9920919dd6ac0d5e9f70dfb413f4c458f109ac1
                                                                                                                                                                                                                                  • Instruction ID: d26f2421ac1976bec8c914b9d83bddfba46f58ce295305a110a35d3d7061f3f8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: acb77376461bb9241e046e9ad9920919dd6ac0d5e9f70dfb413f4c458f109ac1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F931B2FB30C261BFB343C6512B14AFA676ED5C6730331887BF983D6502F298994A2532
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 010724E2 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 98f822753fbd108c800111f74b4818a6e511f0aa2ef53b08209195190ec0dcd9
                                                                                                                                                                                                                                  • Instruction ID: 3132c1c84133351a20018e6ea93f0d5f5d338bd620bc1cea63893e9c8cd5341c
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 98f822753fbd108c800111f74b4818a6e511f0aa2ef53b08209195190ec0dcd9
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 1D51BF70E00208AFDB15DF5CC890AAD7FE1EB89364F258199E8899B352D371DA41CB94
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FF8000 Relevance: 1.6, APIs: 1, Instructions: 150COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • std::locale::_Init.LIBCPMT ref: 00FF8136
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Initstd::locale::_
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1620887387-0
                                                                                                                                                                                                                                  • Opcode ID: bda62cbf4470571c623633dcfd48a2546e6be36ca06fdf4a753abc009643feb4
                                                                                                                                                                                                                                  • Instruction ID: 8ecfbfd01f31553063a9c3b84f4f86609c1a362a8f8d4635a7cde8f63258c463
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: bda62cbf4470571c623633dcfd48a2546e6be36ca06fdf4a753abc009643feb4
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5A51CDB0600606AFEB14DF18C998B5AFBF4FF44314F148269E4098BB81D7B6E955CBD0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF067B Relevance: 1.6, APIs: 1, Instructions: 142COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04DF06D4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: a99d3fe4f09c74064c2bd17adc641ff4d81b657cb97aa7b6f2b85bcb37d503fd
                                                                                                                                                                                                                                  • Instruction ID: 15bbf5f44b4ccaa44e76f06cec40707316114de12c9c9e9555b9289066f4cce9
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a99d3fe4f09c74064c2bd17adc641ff4d81b657cb97aa7b6f2b85bcb37d503fd
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D5218AEB30C011BEB233A5416E40AF6273EE6D27707728466F687D3503F290E94638B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D40502 Relevance: 1.6, APIs: 1, Instructions: 139fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • BaseDllReadWriteIniFile.KERNEL32(?,0000DF87,0000DF87,?,?,?,?,?,?,?,000000E8,?,?,?,000000E8,000000E8), ref: 04D40530
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3025667625.0000000004D40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D40000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d40000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: BaseFileReadWrite
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 234091865-0
                                                                                                                                                                                                                                  • Opcode ID: 74c5be871856bfe2dfea3effe3348085528f3765708d5a00d618aa4202cafa92
                                                                                                                                                                                                                                  • Instruction ID: 07f001ebe29e0a4d0616ab49e375f7558a46aa479dfa6009aede0c290403691d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 74c5be871856bfe2dfea3effe3348085528f3765708d5a00d618aa4202cafa92
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 5F2196FB30C1517FB243D6512B14AFA676ED5C6730730C837FA83D5501F298994A2532
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01002790 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 010028D4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: 55adab7bef0d79729da51631eff21cb24c4506866e49b6672f7f2cd9e6e67e91
                                                                                                                                                                                                                                  • Instruction ID: c207e4f5c92282241a9af35eeacde11097dc51370850fae65edeb7b8431babca
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 55adab7bef0d79729da51631eff21cb24c4506866e49b6672f7f2cd9e6e67e91
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: F4410476A01102AFE719CF7CCD898AEB7A8EB48310B144729F955C73C4E730EE558790
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FFBAE0 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00FFBC31
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: 5c7f2381730bdc60228762133d30f6234c4e11e421e20142680ce4c0cfeb7f16
                                                                                                                                                                                                                                  • Instruction ID: fa4f33c18b59f8187cc8958db03d3663e3a8a1edb14d07ec388c2189b92ef3fe
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5c7f2381730bdc60228762133d30f6234c4e11e421e20142680ce4c0cfeb7f16
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D7412672A001099BDF15DF68DC80ABEB7A9EF84310F140669EA44EB315E731DE21A7E1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04DF06A5 Relevance: 1.6, APIs: 1, Instructions: 131COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • GetCurrentHwProfileW.ADVAPI32(?), ref: 04DF06D4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3034800261.0000000004DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4df0000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CurrentProfile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2104809126-0
                                                                                                                                                                                                                                  • Opcode ID: ff25027b942e842de5a5043a12dcb5c93988dc6bd7d097374c6a2aee9b2fc02e
                                                                                                                                                                                                                                  • Instruction ID: ee77af711c0c1c1212b313dc5cdf2bf32444e13ca5781a128160680d4fed7538
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ff25027b942e842de5a5043a12dcb5c93988dc6bd7d097374c6a2aee9b2fc02e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4D213CEB30C115BEA623A5516E40AF6262EF6D2770B724466F687D3503F290E94629B0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FF5E10 Relevance: 1.6, APIs: 1, Instructions: 130COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00FF5EF7
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: ee8c1e1fd58176ccb8cd4a112ff5c74f57d8d49eecf2ce1b7d2c5909e48318d1
                                                                                                                                                                                                                                  • Instruction ID: 5def46cd7a8d3a464848e4fb13deb873e28ef087fbac23dd37fe4e6f1679ae8d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ee8c1e1fd58176ccb8cd4a112ff5c74f57d8d49eecf2ce1b7d2c5909e48318d1
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 93314D73E007196FD7049F24D8406BAB7A9FF50760F14427AFA158B6A1E731EA90E7E0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00F92A50 Relevance: 1.6, APIs: 1, Instructions: 125COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00F92B87
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: d3d09509cdc6d94a58715c9820ec9a76ceb623340fb542ad72a6657b72d15251
                                                                                                                                                                                                                                  • Instruction ID: 2f640c658fb625abf9d575b39190516bcfe40519ac54b5d2476cf82ce0a7f894
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: d3d09509cdc6d94a58715c9820ec9a76ceb623340fb542ad72a6657b72d15251
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 2D412A72B00101AFEB18DF7CCD849AEB7E9EF943607144268E819CB345EA30ED019761
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00F92910 Relevance: 1.6, APIs: 1, Instructions: 123COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00F92A42
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: c8c0799ca3b8e93ea3a81dfa97b1f8191dd84cfa78eee3a9079bdc701b026b9e
                                                                                                                                                                                                                                  • Instruction ID: a14e1b43910ad48232f56357e4cec7c7ce922a787bb87f1c13e394af8f9af8a0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c8c0799ca3b8e93ea3a81dfa97b1f8191dd84cfa78eee3a9079bdc701b026b9e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E7415A33E00205ABEB15DF6CC8806AEBB65EB94360F1442B9D8589B301E631ED11E7D1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20422 Relevance: 1.6, APIs: 1, Instructions: 122COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: 7a9687081c56866b91903647e39fcfd1a466893be97789fb9d376218a4838d14
                                                                                                                                                                                                                                  • Instruction ID: 0a04bdd428d661f321e7af9c1c1a8d58e794e08fcea3ab0693758f2bc9373f26
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 7a9687081c56866b91903647e39fcfd1a466893be97789fb9d376218a4838d14
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9D21F8E730C521BE720384555B58AFA776DD6E2638330C42AF583CA443F294EE1B7071
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D203AE Relevance: 1.6, APIs: 1, Instructions: 115COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: b2da4abb937e470751300c881ea4cc2e3524aff756c06bb1003fb82574a0788f
                                                                                                                                                                                                                                  • Instruction ID: 2c06b8408c40597f553da36c9ebefebe35d0add32778286bc83a7aece98149f5
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: b2da4abb937e470751300c881ea4cc2e3524aff756c06bb1003fb82574a0788f
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 272192E7308521BDB20785455B549F9A729E5E6738330C43AF583CB543F394AA5B6072
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20375 Relevance: 1.6, APIs: 1, Instructions: 114COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: 5883413783f4f24aff43a9ade02720726e46ac379f635bf34dea722b89d75037
                                                                                                                                                                                                                                  • Instruction ID: 9d4549b8ea4b52a6240a9c51819623d95064d79e99ec03054e64189164da205f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5883413783f4f24aff43a9ade02720726e46ac379f635bf34dea722b89d75037
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 7B21C3E730C531BDB20385856F649FA676DE5E6738730C42AF683C6542F394EA4A7072
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20381 Relevance: 1.6, APIs: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: 5b693910ec9f02e49bf5ed0c827d2f94f56f17ee071369afb2d980201ea7053a
                                                                                                                                                                                                                                  • Instruction ID: e0f9a1ca43a96c31896758e94b547086864f33db0d70091ea2349eb593a02b03
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 5b693910ec9f02e49bf5ed0c827d2f94f56f17ee071369afb2d980201ea7053a
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0011D2E730C531BDB20385856F649FA672DE5E6738730C42AF683C6142F394AE4A7071
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20399 Relevance: 1.6, APIs: 1, Instructions: 108COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: c4804084ad7ed576390c0f142548e36e3667c092ebfb7b9561c5e9a99e5bbaa8
                                                                                                                                                                                                                                  • Instruction ID: 60d920ec55715d513084559819ecff5156d2ccdbce7ab581204a07b677552e15
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: c4804084ad7ed576390c0f142548e36e3667c092ebfb7b9561c5e9a99e5bbaa8
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BE11B1E730C531BDB20385856F649FA676DE6E6738730C42AF683C6542F394AE4A7072
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D203D2 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: fac0b6856df20b48ee782cd1f452a941f48e5a1f5245ec98f130543f78943ec2
                                                                                                                                                                                                                                  • Instruction ID: 042336c368233a3ad347173a4c8d4318b69a7a3ee52a1d2a2c7bb3c2ab3012be
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: fac0b6856df20b48ee782cd1f452a941f48e5a1f5245ec98f130543f78943ec2
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: AA11E0E730C430BD724381456F649FA6B2DE5E6738330C52AF683C6143F294AE4A7032
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20409 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: 4ea31c90c593698923c94fa065a8cf969cf2840904f0b89121856d8bad529496
                                                                                                                                                                                                                                  • Instruction ID: 7627ee196b46262ef46e447256e7941937cc0b0e9b68f27040151847cf8fc147
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 4ea31c90c593698923c94fa065a8cf969cf2840904f0b89121856d8bad529496
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8301289330C831AE620345155B545B8A729E5F633C330C42AF692CB153F394AA4BB072
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20442 Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: 132ef7bbae33bf4bf5a17b3e6813ee99545685bb9483dccc5b73f85901da1152
                                                                                                                                                                                                                                  • Instruction ID: b72b8d871dc163baf18c899b300c2c275b991598ebf8de8dac6af24f217da752
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 132ef7bbae33bf4bf5a17b3e6813ee99545685bb9483dccc5b73f85901da1152
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 77F0C8A730C921AD620345556B589F9B779EAF6738330C52AF692C6052F3A4A70BB071
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20461 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: 136bb83575c938517137e73c92720dc126acc47f13e34d5e18466e7ea974dc23
                                                                                                                                                                                                                                  • Instruction ID: e68e516b2b4b3a04870ae23bf901439ae76d5bc89bb077631a6bc1920eb4fa10
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 136bb83575c938517137e73c92720dc126acc47f13e34d5e18466e7ea974dc23
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: E8F0819B74C831AE620385559B5C4FC7B26E6F2538330C927E582CA067F390D70B70B1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20472 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: 2f0ba84fa5b15612272ddf6da8ac7f35fb98523f83e6590e21c83679aa4b3458
                                                                                                                                                                                                                                  • Instruction ID: fbd520af975ee095ea1120ff2c4f441547da547c919f1caba2f671e8e301b789
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2f0ba84fa5b15612272ddf6da8ac7f35fb98523f83e6590e21c83679aa4b3458
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 94019E2730D2906FD3030A605E885FCBB75EDD393C33944B9E441CB457E250560AD3B1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0107BBFC Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • SetFilePointerEx.KERNEL32(00000000,?,?,?,?,?,00000000,?,?,?,0107BD06,?,?,?,?,?), ref: 0107BC38
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FilePointer
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 973152223-0
                                                                                                                                                                                                                                  • Opcode ID: 26898c618a3684a08e1a9e76758c98703402669530bffb82af611d17de229575
                                                                                                                                                                                                                                  • Instruction ID: 04bce2c9d06f694200fc782918375f307f153ac8ab1034811d8a255c4b956dda
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 26898c618a3684a08e1a9e76758c98703402669530bffb82af611d17de229575
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BA014932B10219AFDF15EF59DC05CEE3B69EF81230B244148FD819B290EA71ED518B90
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D20456 Relevance: 1.6, APIs: 1, Instructions: 50COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: f28518570384520ead26c3bfbf7ca7953b429ef6134434608528cb400108ef40
                                                                                                                                                                                                                                  • Instruction ID: 03ec1c88d9beae5517ec7ca68afc9ae30d47705970d30cd650cdd6e08d62635f
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f28518570384520ead26c3bfbf7ca7953b429ef6134434608528cb400108ef40
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C1F0599730C820ED620345589B589F8B726EAF663C330C566F293C6457F3A4A30BB071
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0106CE31 Relevance: 1.6, APIs: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ___std_exception_copy.LIBVCRUNTIME ref: 00F91FDE
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ___std_exception_copy
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2659868963-0
                                                                                                                                                                                                                                  • Opcode ID: 011f37db451ff1d8098e4b534c176965fcc9b7c1da9ea2779f3ee9fcf49ef5ee
                                                                                                                                                                                                                                  • Instruction ID: cc2086544916bd1856aa3e21df709fb5b285ff3314cb82a0271e3db6ffc091b4
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 011f37db451ff1d8098e4b534c176965fcc9b7c1da9ea2779f3ee9fcf49ef5ee
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 8301DB7590030FA7DB28AAA8EC0059E7BECAF11364B508635F6D4EB550FB70E59086D5
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D204B0 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Process32NextW.KERNEL32(?,5E25F2DB,5E25F2DB,?), ref: 04D204A6
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3024814553.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d20000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: NextProcess32
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1850201408-0
                                                                                                                                                                                                                                  • Opcode ID: f5d20dc9233848e44eef4fc75b0035e88f8ae3b14ea864a881d504f44ed1547b
                                                                                                                                                                                                                                  • Instruction ID: f23d47f533043da67d5635dfb326b7c0f93e48b9e710edefe1924c74349663f7
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f5d20dc9233848e44eef4fc75b0035e88f8ae3b14ea864a881d504f44ed1547b
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: BDF05936748610AFE3034AA48B4C4B9B376FFE223C3308439E10287406F7A0A70AA071
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01083F93 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000008,?,00000016,?,010839C0,00000001,00000364,00000006,000000FF,?,00000016,?,01072112,00000000,00000000), ref: 01083FD5
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                                                  • Opcode ID: ef38ca7a33e5b79367813c0cffd190df8944e6aebb29cada20c04f0be1da1219
                                                                                                                                                                                                                                  • Instruction ID: c6a3d62d950698777f81af3085b9971d421b8c6588eb3a3592e671c8f2169796
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ef38ca7a33e5b79367813c0cffd190df8944e6aebb29cada20c04f0be1da1219
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4BF0E03164D5365BA7617A268C01F9F7BA8BFD1AF0B054051DDC4DE195DB31D80145E0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 00FFEB90 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • Concurrency::cancel_current_task.LIBCPMT ref: 00FFEBE4
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: Concurrency::cancel_current_task
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 118556049-0
                                                                                                                                                                                                                                  • Opcode ID: 45fbaf2ee286f8bf2b17fb06d6875e83cbba74b87cc1d374594b7add5889ce62
                                                                                                                                                                                                                                  • Instruction ID: 8ea928a3d13237259e281a9c994996dab7a701a2785f8a59aa4c1a6b6ed4ba1b
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 45fbaf2ee286f8bf2b17fb06d6875e83cbba74b87cc1d374594b7add5889ce62
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 56F027B290410E0AEB18E3B09941CBE73D8CEA0360744457AE74ACB571FB25F969D116
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 010849CD Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlAllocateHeap.NTDLL(00000000,?,?,?,0106E21B,?,?,E8658904,?,?,00F92D8D,0106B29C,?,?,0106B29C), ref: 010849FF
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                                                                                                  • Opcode ID: f3fcd7b1f5dae8e344ba79305adf8046271792a6fbbbe991b936f24ced13cd5d
                                                                                                                                                                                                                                  • Instruction ID: 41de052e28e6906f269d7916595a8a966a9715642273da433ab6613f1075489a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: f3fcd7b1f5dae8e344ba79305adf8046271792a6fbbbe991b936f24ced13cd5d
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: D4E02B3164D61396E67272698D0079F79CC8F512B0F164165DDD0DA090DE50CC0085F9
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 01084953 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • RtlFreeHeap.NTDLL(00000000,00000000,?,0107B38E,?,?,?,0106E241,00000000,?,E8658904,?,?,00F92D8D,0106B29C), ref: 01084969
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FreeHeap
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 3298025750-0
                                                                                                                                                                                                                                  • Opcode ID: edf71adc5fa53a811814d2ce7165a02c215aab9019c2c145b5e3fd613dcfee72
                                                                                                                                                                                                                                  • Instruction ID: 46b42d3982619d8f1463373676c12f9414c4f44b82d4daa0ff065607735144f8
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: edf71adc5fa53a811814d2ce7165a02c215aab9019c2c145b5e3fd613dcfee72
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: A1E0723230021DAADB323BA8AC00BC87A8C8B02A88F280071FEC88B120DA309C408684
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0106B7B7 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • CreateFileW.KERNELBASE(?,?,00000007,00000000,00000003,?,00000000,?,?,0106B6D9,?,?,00000080,?,?,?), ref: 0106B7CC
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: CreateFile
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 823142352-0
                                                                                                                                                                                                                                  • Opcode ID: 2c6de199d46f0f833ceec73e32b20d40a1a02a3f68042101a4ab0102affdee7e
                                                                                                                                                                                                                                  • Instruction ID: f6a7d1ad9a31cd3dc070b4fc1f44186b92ce757118a8049accbdd9853d8ab10a
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 2c6de199d46f0f833ceec73e32b20d40a1a02a3f68042101a4ab0102affdee7e
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 08E086313411287BDB226EB5EC00EDB7E58EF067B4F040251FA58A71E0C631992097E0
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0107CCC9 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • ExitProcess.KERNEL32(?,?,0107CCC3,00000016,01072143,?,?,68501AD8,01072143,?), ref: 0107CCF3
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: ExitProcess
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 621844428-0
                                                                                                                                                                                                                                  • Opcode ID: 457e8014aa57de2c998103e2813f6bcbc4651212a6667c6da3999e026d43dfc7
                                                                                                                                                                                                                                  • Instruction ID: 0f7aff4ccb9d3924121a6c8accb5e241c335a28771da754e3ccb1a1e28d0749d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 457e8014aa57de2c998103e2813f6bcbc4651212a6667c6da3999e026d43dfc7
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: C9D0A73040210E3FFE253B20CE008DD3F1BDF11244F152414FC880A121CF71A95685D4
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 0106B4A4 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  APIs
                                                                                                                                                                                                                                  • FindNextFileW.KERNELBASE(?,?,?,00F9646F,?,?,?,?,?,?,010B0624,00000001), ref: 0106B4AD
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.2980859971.0000000000F91000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F90000, based on PE: true
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980666684.0000000000F90000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2980859971.00000000010C3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2982010495.00000000010C7000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.00000000010CC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000124D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001335000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.000000000136F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001379000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2987492068.0000000001387000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2995076111.0000000001388000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2997963477.000000000152D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  • Associated: 00000000.00000002.2998680734.000000000152E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_f90000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID: FileFindNext
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID: 2029273394-0
                                                                                                                                                                                                                                  • Opcode ID: 20fd508fdd8caa83f6deccfab395665fc5d7640f7f04548a5cd0cab709d46bed
                                                                                                                                                                                                                                  • Instruction ID: 97b565119a3659f88a83b3db4ac82517f9116de049ada67c182225211b66260d
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 20fd508fdd8caa83f6deccfab395665fc5d7640f7f04548a5cd0cab709d46bed
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 9DC08C3134210CB6AF523AA19C0082ABE8CDF029947009421AEC8C1121DE22E672A2B1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D803DC Relevance: .1, Instructions: 80COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3027328960.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d80000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: a13fffc3b31e734227a0494f7d5bd36ce6a1120a89f35a4b1f92345392a13d73
                                                                                                                                                                                                                                  • Instruction ID: 66070196192ac0badbcbdb50793d859ae9602fde0d64738b1c449a431c4b24f0
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: a13fffc3b31e734227a0494f7d5bd36ce6a1120a89f35a4b1f92345392a13d73
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4301B5E72881157DA213A05A27249F76B7EE0C3730376847BF442D6A03F2C49A4E6072
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D803D3 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3027328960.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d80000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: 11b700818a9ca959ce987e386a5c20b8c2cb96398faefb3efa4d0f918ed1a4bc
                                                                                                                                                                                                                                  • Instruction ID: d6adf2d0703d13a9dc7013a81a306922ab6e2e3c9d79e287b20262f4570b8854
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: 11b700818a9ca959ce987e386a5c20b8c2cb96398faefb3efa4d0f918ed1a4bc
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 4A0162EB2C81157D6043A5892B249FB663EE0C3730332847BF447D5603E6C49A5D30B1
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                                                                                                  Function 04D80401 Relevance: .1, Instructions: 73COMMON
                                                                                                                                                                                                                                  Download Yara Rule
                                                                                                                                                                                                                                  Memory Dump Source
                                                                                                                                                                                                                                  • Source File: 00000000.00000002.3027328960.0000000004D80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D80000, based on PE: false
                                                                                                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                  • Snapshot File: hcaresult_0_2_4d80000_file.jbxd
                                                                                                                                                                                                                                  Similarity
                                                                                                                                                                                                                                  • API ID:
                                                                                                                                                                                                                                  • String ID:
                                                                                                                                                                                                                                  • API String ID:
                                                                                                                                                                                                                                  • Opcode ID: ca129f2ee705e4712fbc3c19a4b96ecab84bbc192145fad05e783f4086b3ef81
                                                                                                                                                                                                                                  • Instruction ID: 376ff7b2beb29ffbe5faedcc247e313807ece91854e737784038071d3faab714
                                                                                                                                                                                                                                  • Opcode Fuzzy Hash: ca129f2ee705e4712fbc3c19a4b96ecab84bbc192145fad05e783f4086b3ef81
                                                                                                                                                                                                                                  • Instruction Fuzzy Hash: 0C0162EB2881517DB113A0992B249FB6A3EE0C7730732847BF453D5607F6C49A5D30B2
                                                                                                                                                                                                                                  Uniqueness

                                                                                                                                                                                                                                  Uniqueness Score: -1.00%